Running dockers (more) securely

[sir_storealot]

Hi,

 

I am a bit frustrated with the lack of security focus and security related patches for unraid. I run a lot of docker-based services via community apps, and while that is really convenient, it seems like a security disaster waiting to happen. None of my stuff is internet facing, however if one docker gets compromised via other means, the rest of the barriers in place is rather weak and many of the used packages in the underlying distro are old and have CVEs open against their versions.

 

Given the currently heightened threat levels, I am therefore looking into alternatives for docker hosting. Maybe run a VM with a docker-friendly system+gui inside unraid, and make sure that gets patched regularly. Clearly not as convenient as Unraid community app dockers, but more secure.

 

Has anybody been experimenting with this, or has a good setup up and running they can recommend?

 

Obviously I appreciate docker is always a security trade-off, however the current situation is really disconcerting.

 

Cheers!

[sir_storealot]

So I have been looking into container isolation a bit over the weekend, and while docker security boundaries do not seem that strong, unraid appears to be using seccomp profiles as recommended, giving a certain degree of security/isolation:

https://docs.docker.com/engine/security/seccomp/

 

I checked a random docker process, and it seems seccomp is indeed enabled:

# grep Seccomp /proc/15401/status
Seccomp:        2
Seccomp_filters:        1

 

# docker info

(...)

 Security Options:
  seccomp
   Profile: default

 

Will dig further once I have more time, any comments or your views appreciated...