DOCKER RUN IMAGE VOLUME HOW TO
DOCKER RUN IMAGE VOLUME INSTALL

ItвЂ™s crucial to understand that kernel does not recognize usernames. When a user wants to perform some action on a file, the kernel checks if the uid has enough privileges to proceed. How do uids map between Docker container and the host?

The server gets the data and attacker can use this data for his evil purposes.

The node app will read the stolenEnv.txt file and will post the data to the server under domain.

It will execute cmd.sh which will steal env of all the running processes on host system and put it in stolenEnv.txt and then it will run the npm start command which will run the node app.

The image will run and it will prepare environment for the node app.

This node app reads the stolenEnv.txt file and makes a post request with the environment variables to.

This file executes the readEnv.sh script and puts the output in stolenEnv.txt, then executes the node app. The output of this file is then stored in the stolenEnv.txt file by the cmd.sh script. This script iterates through all the processes and it prints all the environment variables. This is the file that is the most important. Here is the Dockerfile with environment for node app and with some bash commands to execute. LetвЂ™s prepare some docker image for this scenario. It is a standard approach to keep confidential data like API keys, app settings or secret passphrases in env, so it can be a precious piece of data for the attacker. For example, we can steal some environment variables (env) of processes. An introduction to multithreading in the browser Stealing some private data owned by rootДЄs we have root access we can think of stealing some confidential data. Read also: When async is just not enough. When root executes this command, that is the point when things can get really bad. A basic user can execute this command, but it will not harm the system, as he has no rights to delete core files of the system. Basically, the command removes everything from the / directory on host system. The Docker container executes the rm -rf /home/notImportantDir command inside of the container. The / from the host was mounted in the Docker container as /home/notImportantDir/ directory. Oops, something went wrong? Yep, long story short, you got no system. The -v flag gives us the ability to mount a volume, so we mount / volume from the host and we specify that it will be available at /home/notImportantDir/. LetвЂ™s run this very innocent docker image and give the container / directory as volume. We build the image with Dockerfile from the current directory and we specify a friendly name with the -t option. We want to use the debian:stretch base image, and then execute the rm -rf /home/notImportantDir command. Bare with me as we go through some of the dark scenarios of malicious Docker images. What can possibly go wrong? WellвЂ¦ a lot of things. So when you run a docker process, it gets the privileges of the root. For details on how this impacts security in your system, see Docker Daemon Attack Surface. The docker group grants privileges equivalent to the root user.

DOCKER RUN IMAGE VOLUME INSTALL

When we install the docker, we go through docker post-install. WaitвЂ¦ What? Yes, the user with uuid=0 is a root. It relies on the host kernel, so the user inside of the docker container with uuid=0 is the same user on the host system with uuid=0. The great part of the Docker is that it is lightweight, but what does it entail? The Docker container does not have its own kernel. Docker is sharing a kernel with the host machine Moreover, weвЂ™ll tackle the uid and gid mechanism in linux kernel.

DOCKER RUN IMAGE VOLUME HOW TO

We will consider some scenarios of malicious Docker images and how to protect your host machine from that.

In this article, weвЂ™ll look under the hood of Docker container privileges. A significant part of the IT world relies on Docker containers as they are easy to use and portable.

Docker run image volume