‫The first one is basically do some reading.
‫Like this top part is around
‫giving yourself the basic education of what...how
‫does Docker work? What is basic security in Docker?
‫How does Docker even, you know, protect
‫your container? That sort of stuff.
‫I have basically a production talk you can watch
‫here. We're not going to watch that now.
‫I do have a link here to the Docker security guide.
‫Now, what's interesting about the Docker security guide
‫here is that it's
‫really just about how does Docker security work?
‫Or, how does Docker itself work?
‫There is way better videos in my course.
‫I put links in there to other reference videos that are an
‫entire hour about the underpinnings of Docker.
‫The two main things you need to care about are kernel
‫namespaces and Cgroups.
‫Namespaces, they go through a nice
‫overview of how this stuff works.
‫The summary here is there's two, main features in
‫Linux that allow Docker to
‫even be possible. Kernel namespaces is a way for
‫the kernel to take an application, or a
‫set of applications, and namespace them.
‫Namespace is essentially limiting
‫their view, their access to any resources, or what
‫they see, whether that's networking, other programs in
‫memory, or files on disk, it limits that
‫scope per program.
‫So, it can be for each individual program, and
‫we know those as containers now. Because namespaces isn't
‫specific to Docker. It was around a lot longer than Docker
‫has been. It's been actually around as a
‫concept in different Unix distributions for over a decade.
‫We might have heard this in Solaris
‫Jails or other types of technologies that
‫essentially made you think that you were
‫on your own server, but really, you were contained
‫inside a server with many other people and many other apps,
‫right. We've done that a lot in Linux and hosting
‫platforms.
‫Namespaces is that feature. It gives your container its own
‫NIC. It's a virtual NIC just for that container.
‫It gives it its own file space
‫where it doesn't see the rest of the following file system,
‫and it doesn't let it see other programs running outside of
‫that container. So, it's about its access and view, right.
‫That's namespaces.
‫That just works out-of-the-box.
‫That's how Docker makes a container run without
‫seeing everything else on the system.
‫The other big thing is control groups, or we call them
‫Cgroups for short. Control groups
‫are mostly about limiting resource usage.
‫You can tell a container it only has access to 1GB of RAM,
‫one CPU, that sort of stuff.
‫It also allows for some metrics where you can measure
‫things around that stuff, but it's really mostly
‫about limiting your container. Remember, your
‫containers, by default, can have access to all resources in
‫terms of they can eat up all the file space, they can take
‫all CPUs, and they can eat up all the memory.
‫That's just a standard container, but you can set options
‫in docker run, or in Swarm, or
‫Kubernetes. Any of those things have the ability for
‫you to control resources.
‫But, it's just not by default, right. By default, any
‫container gets everything.
‫When you're going into production, this is definitely on
‫your to do list. I wouldn't say control groups are
‫necessarily a security feature except
‫for a particular application
‫taking up everything that it shouldn't, and then it makes
‫other things not be able to run, right.
‫That's not...I don't look at that as direct security.
‫I look at that as sort of semi-related to security, where
‫someone could technically do a denial of service by
‫letting your app eat up all the resources on
‫your server. So, you know, that kind of thing.
‫Those are the basics.
‫Once you understand the basics, there's a couple of good
‫blog articles here on different types of security tools
‫out there. There's tons of tools,
‫right. I'm not going to mention all of them today.
‫Obviously, there's lots of stuff out there, but a lot of
‫them are complicated and take projects.
‫You have to implement them, or buy them, and then dedicate
‫servers for them, right.
‫Big products around auditing, or
‫making sure you pass certain credentials like
‫a PCI credit card security, or government regulation
‫security, that kind of stuff.