Running dockers (more) securely

Recommended Posts



I am a bit frustrated with the lack of security focus and security related patches for unraid. I run a lot of docker-based services via community apps, and while that is really convenient, it seems like a security disaster waiting to happen. None of my stuff is internet facing, however if one docker gets compromised via other means, the rest of the barriers in place is rather weak and many of the used packages in the underlying distro are old and have CVEs open against their versions.


Given the currently heightened threat levels, I am therefore looking into alternatives for docker hosting. Maybe run a VM with a docker-friendly system+gui inside unraid, and make sure that gets patched regularly. Clearly not as convenient as Unraid community app dockers, but more secure.


Has anybody been experimenting with this, or has a good setup up and running they can recommend?


Obviously I appreciate docker is always a security trade-off, however the current situation is really disconcerting.



Link to comment

So I have been looking into container isolation a bit over the weekend, and while docker security boundaries do not seem that strong, unraid appears to be using seccomp profiles as recommended, giving a certain degree of security/isolation:


I checked a random docker process, and it seems seccomp is indeed enabled:

# grep Seccomp /proc/15401/status
Seccomp:        2
Seccomp_filters:        1


# docker info


 Security Options:
   Profile: default


Will dig further once I have more time, any comments or your views appreciated...

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.