OWASP Top 10 for Docker Containers and Kubernetes Security

Learn how host operating system vulnerabilities in the container host threaten containers and data, with Linux kernel dirty cow as an example, and how patching and access controls mitigate risk.

Explore how reverse shells enable remote command execution in containers, showing how a vulnerable Apache CGI setup can yield a shell, access files, and reveal container context via cgroups.

Identify how insecure container images serve as attack vectors and jeopardize applications. Implement image scanning, signature validation, and minimal base images, while tracking origins and supply chain from trusted registries.

Explore command injection vulnerabilities in a dockerized spring boot app, and examine how encoded curl payloads reveal insecure handling of arbitrary commands.

Identify insecure container configurations and secure them with configuration management, runtime security, and Kubernetes features, then regularly assess capabilities to prevent privilege escalation.

Explores insecure container configurations by showing how misconfigurations and exposed environment variables in base images can expose applications and data to attackers.

secure containers to prevent host system access by addressing container escape vulnerabilities and implementing runtime security, process isolation, and built-in orchestration security features.

Implement process isolation to prevent cross container compromise by applying namespace isolation and cgroups, and use Kubernetes built-in security features to protect data and container resources.

Demonstrates cross-container compromise using the sys_ptrace capability to escape privilege, dump memory, and extract database credentials from another container through privileged access and process tracing.

Prevent unauthorized access and data exfiltration by implementing network segmentation through virtual networks, firewalls, and security groups, and leveraging container orchestration platforms with built-in security features.

Implement centralized logging and monitoring for containerized environments, collecting logs from the host, containers, and the orchestration platform, using SIEM tools and Kubernetes features to detect and respond to attacks.

This lecture covers insecure data storage in containers and shows how encrypting sensitive data, using network attached storage, and applying roll based access controls with Kubernetes reduce breaches.

Mount the Docker socket inside a container to grant the host Docker daemon access and interact with the Docker API, creating security risks for untrusted containers.

Explore mounting the Dhaka circuit inside a container to access the host Docker API, enabling remote code execution and demonstrating privileged container use with Jenkins agents.