The popular container virtualization has arrived on many developer desks and is now approaching more and more production environments. However, many Ops teams are concerned about the security impact of containers. This talk examines the security features of Docker and  introduces the technology behind it. The predominant security function of Docker is isolation, which in turn is implemented not by the Docker software itself, but by a couple of Linux kernel subsystems including namespaces and cgroups. These subsystems are amended by auxiliary protection means such as SELinux and capabilities.

 

These components have to operate in a very coordinated way, since unexpected attack vectors emerge otherwise. The talk explains how, and presents examples of existing (but in the meantime fixed) exploits to demonstrate the issues.

 

Armed with this knowledge participants are able to assess whether Docker corresponds to their individual requirements. Furthermore, it presents a series of best practices that users should implement in Docker to increase their security performance.