{{announcement.body}}
{{announcement.title}}

Hardening Docker Container Using Seccomp Security Profile

DZone 's Guide to

Hardening Docker Container Using Seccomp Security Profile

This article examines Linux's Secure Computing Mode for securing Docker containers through its default and custom configurations.

· Cloud Zone ·
Free Resource

Secure Computing Mode, also known as Seccomp, is a Linux kernel feature that improves several security features to help run Docker in a more secure environment.

It is more like a sandbox environment that not only acts as a firewall for syscalls but also enables you to restrict the actions available within the Docker containers to the host’s Linux kernel.

In this guide, you will learn how to run a container with and without the Seccomp profile.

Prerequisites

To get started with this guide, you need the following:

  • A Linux host with sudo privileges.
  • Seccomp enabled in Linux Kernel.
  • Latest Docker

To verify if your host’s kernel support Seccomp, run the following command in your host’s terminal:

Shell
 




xxxxxxxxxx
1


 
1
$ grep SECCOMP /boot/config-$(uname -r) 
2
 
          
3
CONFIG_HAVE_ARCH_SECCOMP_FILTER=y 
4
CONFIG_SECCOMP_FILTER=y 
5
CONFIG_SECCOMP=


Alternatively, you can also run:

Shell
 




x


 
1
$ grep CONFIG_SECCOMP= /boot/config-$(uname -r) 
2
 
          
3
CONFIG_SECCOMP=y


In both ways, you see CONFIG_SECCOMP=y in your host terminal window. It means it does supports it.

Back in 2016, with version 1.10, Docker had applied a default Seccomp profile. Since then, the profile kept on updating, and now, it has 51 system calls or syscalls and doesn’t make to default whitelist and is effectively blocked. However, you can use your custom profile to unblock the desired syscalls, which we will cover later in this guide.

Now there are a couple of ways to run Docker container with a Seccomp profile, either you can run a docker container with the default profile through the command line, or specify a specific custom profile in .json format, or you can specify your Seccomp profile in Daemon configuration file.

Default Seccomp Profile

If you didn’t specify a Seccomp profile, then Docker uses built-in Seccomp and Kernel configuration. To check this, you can run the following command:

Shell
 




xxxxxxxxxx
1


 
1
$ docker run -it --rm --name alpine-test alpine /bin/sh 
2
 
          
3
Unable to find image 'alpine:latest' locally 
4
latest: Pulling from library/alpine 
5
e6b0cf9c0882: Pull complete 
6
Digest: sha256:2171658620155679240babee0a7714f6509fae66898db422ad803b951257db78 
7
Status: Downloaded newer image for alpine:latest


To see if Seccomp filter is loaded inside the Alpine container:

Shell
 




xxxxxxxxxx
1


 
1
/ # grep Seccomp /proc/$$/status 
2
 
          
3
Seccomp:    2


Here you have grep the pseudo-filesystem to access the kernel data, which indicates that default Seccomp filter was applied inside the running container.

Custom Seccomp Profile

There are scenarios where you want to override the default profile, which gives you extra control and capabilities to play with. In the following example, you are going to use your own custom profile.

We are going to download Docker’s official default profile and make changes to it:

Shell
 




xxxxxxxxxx
1


 
1
$ wget https://raw.githubusercontent.com/docker/labs/master/security/seccomp/seccomp-profiles/default.json -O /path/to/file/your-custom-profile.json


Once you have the .json file with you, it’s time to make changes to the file your-custom-profile.json. For this guide, we are simply going to restrict mkdir command inside the container. To do this, open the file and find mkdir system call, and remove all the references to the mkdir in the file, which could look something like this:

Shell
 




xxxxxxxxxx
1


 
1
...
2
          {
3
             "name": "mkdir",
4
             "action": "SCMP_ACT_ALLOW",
5
             "args": []
6
          }, 
7
... 


Once you edit the profile, try to run the Docker container with it:

Shell
 




xxxxxxxxxx
1


1
$ docker run -it --rm --security-opt seccomp=/path/to/file/your-custom-profile.json --name alpine-custom-seccomp alpine /bin/sh


Shell
 




xxxxxxxxxx
1


 
1
/ # mkdir test 
2
mkdir: can't create directory 'test': Operation not permitted 
3
/ #


The newly created profile container doesn’t allow you to run the mkdir syscall.

This way, you can create your own custom profile and make changes to it as per your requirement, as there are a number of operations which you can restrict like chown, chmod and so on.

Run Container Without Seccomp

For some reason, if you wish to run a container without Seccomp profile, then you can override this by using --security-opt flag with unconfined flag:

Shell
 




xxxxxxxxxx
1


 
1
$ docker run -it --rm --security-opt seccomp=unconfined --name alpine-wo-seccomp alpine /bin/sh


To see if your Docker container runs without Seccomp profile, use this:

Shell
 




xxxxxxxxxx
1


 
1
/ # grep Seccomp /proc/$$/status 
2
 
          
3
Seccomp:    0


You will see Seccomp: 0, which means the container is running without the default Seccomp profile. Note that it is not recommended to do unless you know what you are doing, as a certain security loop-hole will be wide open and can be exploited.

Alternatively, you can use --privileged flag, which can also disable the Seccomp, even if you specify the custom Seccomp profile.


This article was originally published on https://appfleet.com/blog/hardening-docker-container/.

Topics:
cloud native, container security, docker, linux, seccomp

Published at DZone with permission of Sudip Sengupta . See the original article here.

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}