Awesome

awesome-container-security

A collection of container related security resources

Image
Build Management
Networking/Runtime
Security profiles
Exploits
Honeypots
Presentations/Posts

Image

Deepfence Runtime Threat Mapper

Identify vulnerabilities in running containers, images, hosts and repositories

Dagda

Static image analysis tool

Port Authority Open Source Security Scanner for Docker

Understanding and Hardening Linux Containers

The "War and Peace" of container security

Security Assurance Requirements for Linux Application Container Deployments

Department of commerce guidance on container security

Dramatically Reducing Software Vulnerabilities

NIST guidance on reducing software vulnerabilities
NIST security content automation protocol
Extensible Configuration Checklist Description Format (XCCDF) - Goes along with the SCAP link above for specifying a security template that containers should conform to

CoreOS Clair

Utility from CoreOS for automated vulnerability analysis for containers
Clair: The Container Image Security Analyzer (by Joey Schorr & Quentin Machu) - Presentation about the Clair platform
A more polished presentation of Clair at CoreOS Fest 2016

OpenSCAP Container Compliance

Utility for aiding in compliance checks against a container

Actuary

Automated security profiling for Docker image
drydock - Inspired by docker-bench-security with the ability to apply custom security profiles
Docker bench security - One of the first security linting utility for Docker

Buildah

Introduction
Docker image building framework

Packer

Packer builds Docker containers without the use of Dockerfiles. By not using Dockerfiles, Packer is able to provision containers with portable scripts or configuration management systems that are not tied to Docker in any way. It also has a simple mental model: you provision containers much the same way you provision a normal virtualized or dedicated server.

LinuxKit

A toolkit for building custom minimal, immutable Linux distributions

Grafeas

An open-source API to audit and govern your software supply chain

Atomic Reactor

Python library that extends docker build. It's part of the RedHat Atomic project so its rather opinionated

Containers Internals Lab

A series of exercises that provide a deep dive into the internals of containers. Also has a good SELinux training component

Anchore

Free image scanning service with a commercial offering similar to Docker Cloud
anchore-cli

Alpine CVE Check

Specialized CVE scanner

Banyan Collector: A framework to peek inside containers

Framework for peering inside docker images. Useful for rolling your own image scanning system

Commercial solutions

Black Duck Software
Tenable - Includes FlawCheck
GrSecurity - A collection of image hardening tools
Aqua - Full lifecycle container security management platform

Build Management

Habitat.sh

Source to deployment framework. An alternative to Kubernetes and Spinnaker. I include it here because it implements a concept of trusted images and dependency management

Commercial solutions

Project Atomic - RedHat's complete container solution with strong built-in security
Docker Cloud - Continuous scanning of images along with a trust mechanism

Networking/Runtime

kubeadm

Associating Amazon IAM roles to pods

kiam

Also for associating Amazon IAM roles to pods

Secure Container Isolation: Problem Statement & Solution Space

Comprehensive guide from Google engineers on securing and isolating containers

gVisor

User-space kernel designed to provide better isolation/sandboxing of containers

Cilium

Network policy enforcement based on eBPF
Cilium - Container Security and Networking Using BPF and XDP - Thomas Graf, Covalent - Presentation of Cilium by its creator

Linux Monitoring at Scale with eBPF (Brendan Gregg & Alex Maestretti)

bSides SF 2017 talk about container monitoring at Netflix using eBPF

Calico

Security enforcement for Flannel SDN

Kube2IAM

Apply Amazon Identity Management roles to Kubernetes Pods

Envoy

Sidecar and security enforcement system used at Lyft

Romana

Network policy enforcement
Project

Scope

Realtime metrics gathering across the cluster

Whispers in the Hyper-space: High-speed Covert Channel Attacks in the Cloud

An exploration of covert channels

Setting the Record Straight: containers vs. Zones vs. Jails vs. VMs

Contains an interesting point about how contains that share network namespaces can snoop on eachother's traffic

Docker Layer 2 ICC Bug

Containers are able to send raw ethernet frames to other containers with inter-container communication disabled

Commercial solutions

StakRox - Container security solution with adaptive threat protection
NeuVector - Continuous network security
TwistLock - Network activity profiling

Security profiles

bane

AppArmor profile generator for Docker containers

Container security as explained by the three pigs

SELinux for Mere Mortals

A gentle introduction to Security Enhanced Linux

SELinux is no Longer an Option

Firejail

Linux namespaces and seccomp-bpf sandbox. Also works with GUI apps

Docker SELinux Capabilities reference

A handy list of capabilities that are enabled by default in Docker

Detailed post about SELinux Capabilities

An SELinux deep dive

What capabilities do I really need in my container?

Blog post about figuring out what capabilities a container needs

Secure Your Containers with this One Weird Trick

Spoiler, its using SELinux

Falco

Open source container security monitoring
Technical discussion
WTF, My Container Just Spawned a Shell - Jorge Salamero Sanz, Sysdig

Getting towards real sandbox containers

Bubblewrap

Subgraph

Bills itself as an adversary resistant computing platform. Under the hood the idea is to run containers in user space

Linux Containers in 500 Lines of Code

An exercise that also takes you through the nitty gritty details of capabilities management

Exploits

Threat Alert: Kinsing Malware Attacks Targeting Container Environments

From the intro: "We’ve been tracking an organized attack campaign that targets misconfigured open Docker Daemon API ports. This persistent campaign has been going on for months, with thousands of attempts taking place nearly on a daily basis."

harpoon

Post exploitation framework

waitid

CVE-2017-5123
Privledge escalation using the waitid syscall
Detailed write-up

nsenter

This isn't an exploit but it allows user to access the host VM if run in privileged mode

Dirty COW

CVE-2016-5195
Privilege escalation vulnerability in Linux kernel
Proof of concept
Proof of concept collection
Dirty COW and why lying is bad even if you are the Linux kernel

Docker CVE List

List of known security vulnerabilities for Docker

Three Overlooked Lessons about Container Security

Outlines an interesting spear-phishing attack on image maintainers

Docker Scan

Image scanning system with a red-team focus of exploitation

Twitter Vine Source Code Dump

A case study of a vulnerable private registry

Honeypots

How I capture and monitor Wordpress attacks

Capturing exploit attempts by emulating a Wordpress box

DShield

Docker container running cowrie with DShield output enabled

Dockerpot

Fairly old but a great idea for platform to build honeypots

Presentations/Posts

Pets, cattle and insects

An extension of the helpful cattle and pets analogy

Capability based sandboxing

The author presents the intreaging notion of applying the microservices approach to containers where you divide an application apart by capabilities
Awesome Object Capabilities - A language-level implementation of the capability based sandboxing methodology
Linux port of Capsicum related to this LWN post

Introduction to Container Security

GoDaddy's Production Kubernetes Story & Moving Target Defense in Container Envs

Container Security Round Table

Secure Substrate: Least Privilege Container Deployment

A Docker Image Walks Into a Notary

How Secure Are Your Docker Images?

Docker Security Deep Dive - Docker Track

Securing the image pipeline from creation to delivery

Scaling Application Defense with Intent Based Security - Michael Withrow (Twistlock)

A security model to match the deployment model of many orchestration utilities

Container Performance Analysis

Container performance analysis at Netflix. This contains similar material as the bSides talk listed above with
Evolution of Container Usage at Netflix - Also provides insight into container monitoring, logging, and security at Netflix.