Hacking and Securing Docker Containers v2.0

Explore the fundamentals of Docker, including building images and spinning up containers, and learn how these basics underpin the rest of the course.

Docker standardizes building and sharing containerized apps as the de facto standard, using operating system level virtualization to package dependencies into portable images. Share images to avoid missing dependencies.

Explain the differences between virtual machines and containers, noting that VMs run separate operating systems via hypervisors, while Docker containers share the host Linux kernel for a smaller footprint.

Set up the lab by importing a Ubuntu 24 VM into VirtualBox on any host, ensuring Docker is available for hands-on exercises; the VM includes app armor profiles for practice.

Run a container from the web server image in daemon mode with port mapping 8080:80, then verify access at localhost:8080 and explore an interactive shell with docker exec on Alpine.

Explore images vs containers in Docker: an image is a lightweight standalone package with code, runtime, libraries, and settings; a container is a runnable instance created from that image.

Learn how local docker images are stored, including the /var/lib/docker root directory, the overlay2 storage driver, and the creation of image layers and container layers from dockerfile instructions.

Examine Linux namespaces and container isolation, focusing on the user ID namespace, and demonstrate how mounting host directories can let container root access host files.

Explore the Docker attack surface, cover attack categories with practical examples, and examine container escape techniques, privilege escalation, and abuses of the Docker Remote API.

Explore the Docker attack surface. Learn how Docker group users can elevate to root and how remote code execution, container escapes, and backdoored images threaten a cluster.

Explore how publicly uploaded Docker Hub images with known vulnerabilities can compromise containers and hosts, demonstrated by exploiting a Shellshock vulnerability and gaining a reverse shell.

Expose how attackers backdoor Docker images using Docker scan to inject a reverse shell payload into an Ubuntu image. Ensure private registries and image verification.

Demonstrates how Docker group members can escalate to root by exploiting setuid binaries and host-mounted volumes, leveraging Docker daemon privileges.

Explore container breakout techniques, showing how attackers escape containers to reach the host using exploits on unpatched Docker environments, overprivileged containers, and dangerous mount points.

Understand how the Docker socket and Unix socket enable Docker commands via the Docker daemon and Docker CLI, including remote access, mounting /var/run/docker.sock into containers, and the associated security risks.

Demonstrates how mounting the docker.sock into a container enables a post-exploitation attack, spawning a new container and reading a host root file named crackme.txt to illustrate container escape.

Compare a container with and without the Docker --privileged flag and view the expanded capabilities. Learn how an attacker could escape to the host.

The video demonstrates how a privileged container can load a kernel module onto the host kernel when caps module capability is enabled, including transferring the module, insmod, and lsmod verification.

Demonstrates loading a kernel module to spawn a reverse shell from a compromised container to the host, using call_user_mode_helper with bin bash, argv, and envp.

Explore why storing secrets in environment variables and source code is risky in Docker and how attackers access them inside containers and on the host, including Hashicorp Vault.

Explore how automated tools audit Docker hosts, images, and containers, and shift from fundamentals and attacks to defenses across the rest of the course.

Use trivia, a simple vulnerability scanner for containers, to perform static analysis on docker images, revealing 145 vulnerabilities, including the Heartbleed CVE 2014 0160, and showcasing its ci/cd relevance.

Auditing with Docker bench security, this lecture shows how a script scans Docker deployments for best practices and improves security by fixing issues and enforcing CPU limits and non-root users.

Explore defense in depth for docker environments by leveraging apparmor, seccomp, and capabilities, while understanding attacks on the docker daemon, container escape, and backdooring images—without using privileged containers.

Explore AppArmor, a Linux security module, and how to create, load, and apply custom profiles to Docker containers. Verify rules that block /tmp writes and protect /etc/shadow.

Seccomp profiles filter which system calls a Docker container can run, blocking specific syscalls like cmod by default; use security opt to load a profile, while privileged mode disables seccomp.

Explore how root privileges split into capabilities, and how Docker drops all by default with a whitelist, allowing granular control by adding or dropping capabilities in the bonding set.

Enable Docker content trust to pull only signed images, which verifies publishers, signatures, and expiration dates and resolves tags to sha256 digests.

Wraps up the hacking and securing docker containers v2.0 course and invites learners to share the experience with friends and colleagues.