security - 安全地运行 docker

Question

我了解 docker 守护进程需要 runs as root所以我被告知这可能会导致一些安全隐患，例如如果容器遭到破坏，攻击者可以更改主机的系统文件。

发生攻击时我可以采取哪些预防措施来减轻损失？

运行 docker 守护进程时有什么我应该注意的做法吗？我考虑过让一个流浪者启动一个虚拟机，然后让 docker 在虚拟机中运行。

Answer 1

有关 docker 安全实践的主要信息来源是“Docker security”页面。

only trusted users should be allowed to control your Docker daemon.
This is a direct consequence of some powerful Docker features.

Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container.

如果您公开 REST API，则应通过 https 进行。

Finally, if you run Docker on a server, it is recommended to run exclusively Docker in the server, and move all other services within containers controlled by Docker

关于虚拟机，请参阅“Are Docker containers really secure?”

The biggest problem is everything in Linux is not namespaced. Currently, Docker uses five namespaces to alter processes view of the system: Process, Network, Mount, Hostname, Shared Memory.

While these give the user some level of security it is by no means comprehensive, like KVM (Kernel-based Virtual Machine).
In a KVM environment processes in a virtual machine do not talk to the host kernel directly. They do not have any access to kernel file systems like /sys and /sys/fs, /proc/*.