Container Security: Issues, Challenges, and the Road Ahead

Abstract

Containers emerged as a lightweight alternative to virtual machines (VMs) that offer better microservice architecture support. The value of the container market is expected to reach $2.7 billion in 2020 as compared to $762 million in 2016. Although they are considered the standardized method for microservices deployment, playing an important role in cloud computing emerging fields such as service meshes, market surveys show that container security is the main concern and adoption barrier for many companies. In this paper, we survey the literature on container security and solutions. We have derived four generalized use cases that should cover security requirements within the host-container threat landscape. The use cases include: (I) protecting a container from applications inside it, (II) inter-container protection, (III) protecting the host from containers, and (IV) protecting containers from a malicious or semi-honest host. We found that the first three use cases utilize a software-based solutions that mainly rely on Linux kernel features (e.g., namespaces, CGroups, capabilities, and seccomp) and Linux security modules (e.g., AppArmor). The last use case relies on hardware-based solutions such as trusted platform modules (TPMs) and trusted platform support (e.g., Intel SGX). We hope that our analysis will help researchers understand container security requirements and obtain a clearer picture of possible vulnerabilities and attacks. Finally, we highlight open research problems and future research directions that may spawn further research in this area.

Challenges in Docker Development

“…"). As stated earlier, the Basic Concepts topic has the highest number of posts which is inline with general understanding that developers are still looking for primary knowledge relating to Docker [35].…”

Análise de segurança entre contêineres Docker implementados em Linux e Windows

“…Os critérios utilizados foram baseados no guia de segurança de contêineres [NIST 2017], no modelo de ameaças [Sultan et al 2019] e na revisão de falhas de segurança em contêineres Linux [Lin et al 2018]. Uma análise visando restringir a quantidade de critérios foi realizada para definir um foco inicial na pesquisa deste artigo, que pode ser ampliado a medida que as análises de cada critério são finalizadas.…”

“…Há estudos sobre segurança de contêineres Docker na plataforma GNU/Linux, mas não foram identificados estudos analisando a segurança do Docker Windows até o momento da submissão deste artigo. O presente trabalho tem como objetivo definir um escopo de análise de segurança de contêineres Docker, tanto GNU/Linux como Windows, utilizando como base os critérios de [Sultan et al 2019]: (i) Controle e limitação de recursos e (ii) Segurança das imagens de contêineres.…”

The implementation of Container as a Service (CaaS) cloud using openSUSE kubic

“…There has been several of previous researches covering containers, Container as a Service (CaaS) Cloud, docker, and Kubernetes on DevOps. Literature study regarding container security and solutions is discussed by [12], using four use cases, namely: protecting a container from applications inside it, inter-container protection, protecting the host from containers, and protecting containers from a malicious host. The results of this research are container security requirements and possible vulnerabilities and attacks.…”