Docker-Sec: A Fully Automated Container Security Enhancement Mechanism

Loukidis-Andreou, Fotis; Giannakopoulos, Ioannis; Doka, Katerina; Koziris, Nectarios

doi:10.1109/icdcs.2018.00169

Cited by 24 publications

(15 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Loukidis-Andreou et al [56] presented an automated system to enhance Docker container security that is based on AppArmor LSM called Docker-sec. Docker-sec includes two primary mechanisms.…”

Section: ) Linux Security Modules (Lsms)mentioning

confidence: 99%

Container Security: Issues, Challenges, and the Road Ahead

2019

View full text Add to dashboard Cite

Containers emerged as a lightweight alternative to virtual machines (VMs) that offer better microservice architecture support. The value of the container market is expected to reach $2.7 billion in 2020 as compared to $762 million in 2016. Although they are considered the standardized method for microservices deployment, playing an important role in cloud computing emerging fields such as service meshes, market surveys show that container security is the main concern and adoption barrier for many companies. In this paper, we survey the literature on container security and solutions. We have derived four generalized use cases that should cover security requirements within the host-container threat landscape. The use cases include: (I) protecting a container from applications inside it, (II) inter-container protection, (III) protecting the host from containers, and (IV) protecting containers from a malicious or semi-honest host. We found that the first three use cases utilize a software-based solutions that mainly rely on Linux kernel features (e.g., namespaces, CGroups, capabilities, and seccomp) and Linux security modules (e.g., AppArmor). The last use case relies on hardware-based solutions such as trusted platform modules (TPMs) and trusted platform support (e.g., Intel SGX). We hope that our analysis will help researchers understand container security requirements and obtain a clearer picture of possible vulnerabilities and attacks. Finally, we highlight open research problems and future research directions that may spawn further research in this area.

show abstract

“…Loukidis-Andreou et al [56] presented an automated system to enhance Docker container security that is based on AppArmor LSM called Docker-sec. Docker-sec includes two primary mechanisms.…”

Section: ) Linux Security Modules (Lsms)mentioning

confidence: 99%

Container Security: Issues, Challenges, and the Road Ahead

2019

View full text Add to dashboard Cite

show abstract

“…The work "Docker-Sec: A Fully Automated Container Security Enhancement Mechanism", one of the most visualized of the cluster, deals with a prevention mechanism of systems based on microservices that use Docker containers. According to this article, the use of containers brings several challenges regarding security, due to "their direct communication with the host kernel, allowing attackers to break into the host system and co-located containers more easily than Virtual Machines" (Loukidis-Andreou et al, 2018) proposing then an automated mechanism called Docker-sec for the creation of rules and configurations in containers in order to protect containers from vulnerabilities with minimal loss of performance.…”

Section: Data Presentation and Inter-relationsmentioning

confidence: 99%

Secure Microservices - A Review Applying the Theory of the Consolidated Meta-Analytic Approach

2020

IJWI

View full text Add to dashboard Cite

“…One of the most efficient way to prevent such kind of attacks is to apply Linux Security Module (LSM), which is a kernel-level security framework initially targeting Linux [6]. In this paper, we first studied a recently proposed LSM called Docker-sec [22]. Docker-sec is a user-friendly security module based on AppArmor to protect Docker containers through their entire lifecycle.…”

Section: Introductionmentioning

confidence: 99%

Lic-Sec: an enhanced AppArmor Docker security profile generator

Zhu

Gehrmann

2020

Preprint

View full text Add to dashboard Cite

Along with the rapid development of cloud computing technology, containerization technology has drawn much attention from both industry and academia. In this paper, we perform a comparative measurement analysis of Docker-sec, which is a Linux Security Module proposed in 2018, and a new AppArmor profile generator called Lic-Sec, which combines Docker-sec with a modified version of LiCShield, which is also a Linux Security Module proposed in 2015. Docker-sec and LiCShield can be used to enhance Docker container security based on mandatory access control and allows protection of the container without manually configurations. Lic-Sec brings together their strengths and provides stronger protection. We evaluate the effectiveness and performance of Docker-sec and Lic-Sec by testing them with real-world attacks. We generate an exploit database with 42 exploits effective on Docker containers selected from the latest 400 exploits on Exploit-db. We launch these exploits on containers spawned with Docker-sec and Lic-Sec separately. Our evaluations show that for demanding images, Lic-Sec gives protection for all privilege escalation attacks for which Docker-sec failed to give protection.

show abstract

Docker-Sec: A Fully Automated Container Security Enhancement Mechanism

Cited by 24 publications

References 3 publications

Container Security: Issues, Challenges, and the Road Ahead

Container Security: Issues, Challenges, and the Road Ahead

Secure Microservices - A Review Applying the Theory of the Consolidated Meta-Analytic Approach

Lic-Sec: an enhanced AppArmor Docker security profile generator

Contact Info

Product

Resources

About