sir_storealot Posted May 5, 2022 Share Posted May 5, 2022 Hi, I am a bit frustrated with the lack of security focus and security related patches for unraid. I run a lot of docker-based services via community apps, and while that is really convenient, it seems like a security disaster waiting to happen. None of my stuff is internet facing, however if one docker gets compromised via other means, the rest of the barriers in place is rather weak and many of the used packages in the underlying distro are old and have CVEs open against their versions. Given the currently heightened threat levels, I am therefore looking into alternatives for docker hosting. Maybe run a VM with a docker-friendly system+gui inside unraid, and make sure that gets patched regularly. Clearly not as convenient as Unraid community app dockers, but more secure. Has anybody been experimenting with this, or has a good setup up and running they can recommend? Obviously I appreciate docker is always a security trade-off, however the current situation is really disconcerting. Cheers! Quote Link to comment
sir_storealot Posted May 9, 2022 Author Share Posted May 9, 2022 So I have been looking into container isolation a bit over the weekend, and while docker security boundaries do not seem that strong, unraid appears to be using seccomp profiles as recommended, giving a certain degree of security/isolation: https://docs.docker.com/engine/security/seccomp/ I checked a random docker process, and it seems seccomp is indeed enabled: # grep Seccomp /proc/15401/status Seccomp: 2 Seccomp_filters: 1 # docker info (...) Security Options: seccomp Profile: default Will dig further once I have more time, any comments or your views appreciated... Quote Link to comment
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.