‫All right. First up is just running in
‫Docker.
‫This requires you to sort of create an argument,
‫because this is probably...if you're having a barrier with
‫this, right. Just using Docker, number one.
‫If you can't get this done.
‫Well, one, you're probably watching my show.
‫But, that probably means you have a security team, or
‫management, that has read something somewhere that there's
‫security around Docker.
‫The latest thing was, if you scroll down to the bottom
‫of this issue, is
‫that there are images out there now.
‫And, you know, it's not news to anyone that
‫if you run random software off the Internet without
‫checking it first, you may end up with a virus.
‫Basically, people are creating images on Docker
‫Hub with cryptocurrency or cryptojacking
‫tools inside them that will essentially run,
‫you know...you think you're running this other piece of
‫software, but you're really running something nefarious
‫for the hackers.
‫Well, this is not new, and Docker doesn't necessarily make
‫this any easier than anything else.
‫We all know the rules. Don't run random images, just like
‫you wouldn't run random code on your server.
‫You don't download random stuff
‫from the Internet. So, don't do that in images.
‫Only run official images or those that you absolutely
‫trust. Meaning, you know the vendor.
‫The vendor is staking their relationship with you on that
‫image, and you don't necessarily have to scan the image
‫with every line of code.
‫But, you know, you're using reputable products from
‫reputable companies, right.
‫If you're doing that, this whole local...this all
‫recent news thing that made a bunch of headlines, doesn't
‫even matter. It wasn't a vulnerability in
‫Docker. It was people configuring Docker by disabling
‫security that was in and out-of-the-box and then going and
‫downloading random software and images.
‫Of course, they're going to have problems, right.
‫I think the real news there is that hackers
‫are getting more sophisticated. They know more of us are
‫running containers, so they will start putting viruses in
‫container images, right. And Docker Hub does not scan every
‫image. It only scans for security issues in official
‫images. That's not a feature of Docker Hub anymore.
‫Well, they never did it for everyone because there's
‫millions, there's, I don't know, 30 million images.
‫You could pay them in the past, and you know, you can't
‫pay them anymore for that. All right.
‫Step one is just using Docker.
‫In case you didn't know, when you use Docker
‫out-of-the-box, it is already hardening the
‫application in there. One, that application can't see the
‫rest of what's running on the system. So, it can't even
‫access the rest of this stuff running.
‫It's just only what's in that container, right.
‫The real big thing there, though, is that a container in
‫Docker enables a bunch of Linux
‫security features that normally, if you just run apps on
‫the host, aren't enabled by default.
‫That includes Seccomp, AppArmor,
‫SELinux and kernel capabilities.
‫Those four things are all inside of Docker and
‫enabled by default, assuming your host supports them
‫because not every Linux distribution supports every
‫security tool. But those four things, especially AppArmor,
‫Seccomp and Linux
‫capabilities are enabled out-of-the-box for every container
‫you run. Which is why sometimes certain
‫applications, you know you have to run it like --privilege.
‫You kind of have to run it with the privilege mode.
‫That's because those defaults are conflicting with whatever
‫that app wants to do. Because those defaults that Docker
‫sets are common for
‫most applications to work correctly.
‫So, Docker basically went through a whole bunch of tools
‫way back in the day, scanned a whole bunch of common open
‫source software, and figured out what they all
‫tend to have in common in terms of rights, in
‫terms of permissions on the host. They took the rest of
‫them, you know, hundreds of other things that the regular
‫applications can have access to,
‫and they took them away.
‫That resulted in Docker having
‫a very secure default profile.
‫So, if you just run Nginx on a host, it has access
‫to everything in the kernel that that user has access to,
‫which is usually most of everything.
‫But, if you run it in a container, it locks so much of that
‫down that it's automatically secure, more
‫secure, out-of-the-box, even if you didn't customize
‫any of those things. That's my argument for like why Docker
‫for security. Just do it, and you automatically get all
‫these things enabled. Most people don't know about
‫how to use AppArmor or how to use Seccom, or
‫SELinux, how to customize those things for each
‫application. But, Docker did, and that's what they do
‫out-of-the-box.