Record · corpus.blog/posts/01a08c63-a7a4-7112-a23e-689c139a0531

Docker and OCI: a humble hardening guide

wonderfall.dev · published 30 March 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at wonderfall.dev Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
External links: 37
Words captured: 4,648

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://docs.docker.com/compose/compose-file/

docs.docker.com

https://hub.docker.com/

hub.docker.com

https://cloud.google.com/container-registry

cloud.google.com

https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry

docs.github.com

https://alpinelinux.org/

alpinelinux.org

https://github.com/GoogleContainerTools/distroless

github.com

https://docs.docker.com/develop/develop-images/multistage-build/

docs.docker.com

https://github.com/aquasecurity/trivy

github.com

https://www.trendmicro.com/vinfo/fr/security/news/virtualization-and-cloud/malicious-docker-hub-container-images-cryptocurrency-mining

trendmicro.com

https://docs.docker.com/engine/security/trust/

docs.docker.com

https://github.com/notaryproject/notary

github.com

https://github.com/sigstore/cosign

github.com

https://github.com/sse-secure-systems/connaisseur

github.com

https://grsecurity.net/huawei_hksp_introduces_trivially_exploitable_vulnerability

grsecurity.net

New Linux Vulnerability CVE-2022-0492 Affecting Cgroups: Can Containers Escape? Read at the source ↗

unit42.paloaltonetworks.com

Breaking out of Docker via runC – Explaining CVE-2019-5736 Read at the source ↗

unit42.paloaltonetworks.com

https://www.man7.org/linux/man-pages/man7/user_namespaces.7.html

man7.org

https://lists.archlinux.org/pipermail/arch-general/2017-February/043066.html

lists.archlinux.org

https://www.openwall.com/lists/oss-security/2022/01/29/1

openwall.com

https://docs.kernel.org/userspace-api/no_new_privs.html

docs.kernel.org

https://forums.grsecurity.net/viewtopic.php?f=7&t=2522

forums.grsecurity.net

https://github.com/moby/moby/blob/1308a3a99faa13ff279dcb4eb5ad23aee3ab5cdb/oci/caps/defaults.go

github.com

https://github.com/moby/moby/tree/85eaf23bf46b12827273ab2ff523c753117dbdc7/profiles/apparmor

github.com

https://github.com/moby/moby/blob/85eaf23bf46b12827273ab2ff523c753117dbdc7/profiles/seccomp/default.json

github.com

https://kubernetes.io/docs/tutorials/security/seccomp/

kubernetes.io

https://docs.docker.com/engine/security/seccomp/

docs.docker.com

Containers, Security, and Echo Chambers Read at the source ↗

blog.jessfraz.com

https://docs.docker.com/config/containers/resource_constraints/

docs.docker.com

https://github.com/compose-spec/compose-spec/blob/master/spec.md

github.com

https://github.com/containers/crun

github.com

https://github.com/containers/youki

github.com

https://gvisor.dev/

gvisor.dev

https://github.com/google/gvisor/blob/86ad7d5b5838da1b539e976886d04b93c939ca3d/runsc/boot/filter/config.go

github.com

https://github.com/google/gvisor/blob/6ef268409620c57197b9d573e23be8cb05dbf381/pkg/sentry/kernel/task_identity.go

github.com

https://gvisor.dev/docs/user_guide/install/

gvisor.dev

https://katacontainers.io/

katacontainers.io

https://firecracker-microvm.github.io/

firecracker-microvm.github.io