Run a container with least privilege
Start the same web container twice, once with defaults and once hardened, and compare what each one is allowed to do.
Environment
Docker Desktop on your PC, or Docker Engine in a Linux VM. Run everything on your own machine.
Before you start
- Read Application Virtualization and Container Virtualization (p.161) and Cloud Automation Technologies (p.164).
You will
- Inspect a running container
- Apply non-root, read-only and dropped-capability settings
- Describe how containers are isolated
Steps
-
1
Run a default container:
docker run -d --name web1 -p 127.0.0.1:8081:80 nginx:alpineand open http://127.0.0.1:8081. -
2
Check who it runs as:
docker exec web1 id. The master process runs as root. -
3
Run a hardened copy:
docker run -d --name web2 -p 127.0.0.1:8082:8080 --read-only --tmpfs /tmp --cap-drop ALL --security-opt no-new-privileges nginxinc/nginx-unprivileged:alpine. -
4
Check it:
docker exec web2 idshows a non-root user, anddocker exec web2 touch /testfails because the filesystem is read-only. -
5
Compare the two with
docker inspect web1anddocker inspect web2, looking atReadonlyRootfs,CapDropandSecurityOpt. -
6
Write the hardened settings into a
docker-compose.yml. This is your first piece of infrastructure as code. -
7
Clean up:
docker rm -f web1 web2.
Check your understanding
- ?Why does running as non-root matter if the app inside is compromised?
- ?How is a container different from a VM in terms of isolation?
- ?How does putting the settings in a Compose file help with consistency?