SlideShare a Scribd company logo

Veer's Container Security

J
Jim Barlow

Container security involves securing containers at both the host and application level. At the host level, Linux technologies like namespaces, cgroups, SELinux, and seccomp provide isolation between containers. Container images are also scanned for vulnerabilities. The OpenShift platform provides additional security features like role-based access control, network policies, encrypted communications, and controls over privileged containers and storage. Application security best practices within containers include using HTTPS, securing secrets, and API management tools.

Software
1 of 49
Downloaded 82 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
@OpenShift RHOpenShift Container Security Presenter: Veer Muchandi Title: Principal Architect - Container Solutions Social Handle: @VeerMuchandi Blogs: https://blog.openshift.com/author/veermuchandi/
What Are Containers? ● Sandboxed application processes on a shared Linux OS kernel ● Simpler, lighter, and denser than virtual machines ● Portable across different environments ● Package my application and all of its dependencies ● Deploy to any environment in seconds and enable CI/CD ● Easily access and share containerized components INFRASTRUCTURE APPLICATIONS It Depends on Who You Ask 2
Understanding Containers
Virtualization vs Containerization
Container Host Security Linux Technologies - Namespaces for Isolation - Seccomp - Read Only Mounts - SELinux - MCS - RHEL Atomic Base Image build your applications - RHEL or RHEL-Atomic
Linux Containers Architecture
Kernel provides process isolation by creating separate namespaces for containers PID namespaces allow processes in different containers to have the same PID Network namespaces allows container to use separate virtual network stack, loopback device and process space Mount namespaces isolate the set of file system mount points UTS namespaces isolate system identifiers – nodename and domainname IPC namespaces isolate certain interprocess communication (IPC) resources User allow you to specify a range of host UIDs dedicated to the container. A process can have full root privileges for operations inside the container.
Cgroups ensure that a single container cannot exhaust a large amount of system resources Cgroups allocate CPU time, system memory, network bandwidth, or combinations of these among user-defined groups of tasks
9 SELinux and Multi Category Security ● Mandatory Access Control ● SElinux is a LABELING system ● Every Process has a Label ● Every file, Directory, System object has a Label ● Policy rules control access between labeled processes and labeled objects ● The Kernel enforces the rules
10 SELINUX - MAC - MCS - Process system_u:system_r:container_runtime_t:s0 SElinux Policy module for the container The OOTB SElinux policy container.te defines what you can execute and access with the label container_runtime_t [root@osemaster ~]# ps -efZ | grep docker-containerd-shim-current system_u:system_r:container_runtime_t:s0 root 3035 1479 0 Feb15 ? 00:00:01 /usr/bin/docker-containerd-shim-current 4d254785cbc6ee7aae8facc48555251e2385f65d89553b319b6324b1501e4b16 /var/run/docker/libcontainerd/4d254785cbc6ee7aae8facc48555251e2385f65d89553b319b6324b1501e4b16 /usr/libexec/docker/docker-runc-current
11 SELINUX - MAC - MCS - Files container_var_lib_t / svirt_sandbox_file_t SElinux Policy module for the container [root@osemaster ~]# ls -lZ /var/lib/docker/containers/97de4217a04b6532e312cfb3e4638529aeb7dfa281a2cc067e092fcee82e6737 / -rw-r-----. root root system_u:object_r:container_var_lib_t:s0 97de4217a04b6532e312cfb3e4638529aeb7dfa281a2cc067e092fcee82e6737-json.log -rw-rw-rw-. root root system_u:object_r:container_var_lib_t:s0 config.v2.json -rw-rw-rw-. root root system_u:object_r:container_var_lib_t:s0 hostconfig.json -rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0 hostname -rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 hosts -rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0 resolv.conf -rw-r--r--. root root system_u:object_r:container_var_lib_t:s0 resolv.conf.hash drwxr-xr-x. root root system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 secrets drwx------. root root system_u:object_r:container_var_lib_t:s0 shm
12 SECCOMP - DROPPING PRIVILEGES FROM CONTAINERS CAP_SETPCAP CAP_SYS_MODULE CAP_SYS_RAWIO CAP_SYS_PACCT CAP_SYS_NICE CAP_SYS_RESOURCE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_AUDIT_WRITE CAP_AUDIT_CONTROL CAP_MAC_OVERRIDE CAP_MAC_ADMIN CAP_SYSLOG CAP_NET_ADMIN CAP_SYS_ADMIN Modify process capabilities Insert/Remove kernel modules Modify Kernel Memory Configure process accounting Modify Priority of processes Override Resource Limits Modify the system clock Configure tty devices Write the audit log Configure Audit Subsystem Ignore Kernel MAC Policy Configure MAC Configuration Modify Kernel printk behaviour Configure the network: - Setting the hostname/domainname - mount(),unmount() - nfsservctl - ….
13 SECCOMP - REMOVE PRIVILEGES FROM CONTAINERS A root user inside a container running in OpenShift has none of the previous capabilities available!
14 Read Only Mounts /sys /proc/sys /proc/sysrg-trigger /proc/irq /proc/bus
Container Build Time Security - Content in the containers, Trusted Containers - Responsibility of maintaining Container Images - Container Registry - RBAC, Public and Private Registries - Scanning for Vulnerabilities - Integrating Container Scanning and SAST into CI/CD - Future Vulnerabilities - Build Automation to rebuild during fixes
● Red Hat Container Registry ● Policies to control who can deploy which containers ● Certification Catalog ● Trusted content with security updates HOST OS CONTAINER OS RUNTIME APP HOST OS CONTAINER OS RUNTIME APP 16 Image governance and private registries ● What security meta-data is available for your images? ● Are the images in the registry updated regularly? ● Are there access controls on the registry? How strong are they? Trusting Container Content
Red Hat provides Trusted Container Images (registry.access.redhat.com) Languages: PHP, Python, Ruby, Perl, Node.js, Java, .Net Core Enterprise Grade JBoss Middleware: EWS, EAP, BPM, BRMS, RH SSO, Data Grid, DataVirt, 3Scale Databases: MySQL, Mongo, PostgreSQL, Maria CICD: Jenkins Partners Images: Container Certification by Red Hat. Publish fixes to the content in this registry and notify you.
18 Red Hat Registry: Container Health Index https://access.redhat.com/articles/2803031
Private Registries What if public registry (like DockerHub) is down? Enterprise security policies may not allow your Container Images to be pushed outside. Caching images in Private Registry - Atomic Registry with RBAC - JFrog Artifactory - Docker Trusted Registry
20 RESTRICT WHERE YOUR CONTAINERS COME FROM - name: allow-images-from-internal-registry onResources: - resource: pods - resource: builds matchIntegratedRegistry: false - name: allow-images-from-dockerhub onResources: - resource: pods - resource: builds matchRegistries: - docker.io
Responsibilities in the new paradigm Operations - Maintain Trusted OS Base Images (RHEL, RHEL-Atomic) - Ensure these are good with Linux Kernel System Engineers/Architects - Maintain Middleware Images - Control build process - S2I, CICD - Reference Architectures with Trusted middleware Development teams - Write code that layers on approved images - Ensure code is clean, opensource software vullnerabilities are handled
Container Scanning Frequency Scan containers as soon as they are created Scan containers that get into registry Ongoing basis- Identify any new vulnerabilities “Deny execution of containers that are vulnerable”
23 Scanning containers when created https://www.youtube.com/watch?v=65BnTLcDAJI Run the scan at this point
Scanning Tools Atomic Scan - configurable with different scanners OpenScap Scanner - also built into CloudForms BlackDuck JFrog XRay
25 Identify Vulnerabilites on an ongoing basis
26 Vulnerable? CloudForms takes Action!
27 Prevent Image From Running
28 Build Automation - when there are updated images
Container Platform Security - Authentication - Authorization - Running Privileged Containers - Network Isolation - Securing communication between hosts - Storage Security - Deploying workloads to specific hosts of your choice
API Authentication • OAuth Access Token – Obtained from OAuth server using endpoints – Sent as • X.509 Client Certs – HTTPS connection – API Server verifies against a trusted cert authority bundle – API Server creates and distributes certs to Controllers to authenticate themselves • Request with invalid token or cert gets a 401 • No cert or token gets system:anonymous user and system: unauthenticated virtual group <master>/oauth/authorize <master>/oauth/token Authorization: Bearer access_token=…​
Authentication OAuth Client OAuth Server Master Client Types: openshift-web-console openshift-browser-client openshift-challenging-client Identity Provider 1. Authentication Request 2. Determine Identity 3. Access token Configured Identity Providers: - LDAP - GitHub - GitLab - Google - OpenID Connect - HTPasswd Authentication Requests: <master>/oauth/authorize WWW-authenticate <master>/oauth/token/request
Authorization RoleBinding associates Users/Groups with Roles - Cluster RoleBindings - Project RoleBindings
33 Container Deployment Permissions (SCC)
Network Isolation with Network Policy Objects Add Network Policies To Allow Specific Incoming Traffic
35 Secured Communications between Hosts Secures cluster communications with IPsec ● Encryption between all Master and Node hosts (L3) ● Uses OpenShift CA and existing certificates ● Simple setup via policy defn ○ Groups (e.g. subnets) ○ Individual hosts Master P1 Nodes P2 172.16.0.0/16
36 Secure storage by using ● SELinux access controls ● Secure mounts ● Supplemental group IDs for shared storage Securing Storage attached to Containers
37 Isolate Workloads by labeling Nodes Node 1 east Node 2 east Node 1 west Node 2 west Master / Scheduler $ oadm new-project myproject --node-selector='type=user-node,region=east' pod pod
38 Securing federated clusters across data centers or environments ● Authentication and authorization ● API endpoints ● Secrets ● Namespaces FEDERATED CLUSTERS (Roadmap) ROLES & ACCESS MANAGEMENT Source: Building Globally Distributed Services using Kubernetes Cluster Federation. October 14, 2016
39 FEDERATED CLUSTERS (Roadmap) ROLES & ACCESS MANAGEMENT Source: Building Globally Distributed Services using Kubernetes Cluster Federation. October 14, 2016 API Repl Ctrl Ubernetes state API Repl Ctrl Kubernetes Cluster state API Repl Ctrl Kubernetes Cluster state
Application Security - Running as Containers - API Management - Red Hat Single Sign-on - HTTP(s) - Securing sensitivedata as Secrets - Calling services running outside a Container Platform
41 Container platform & application APIs ● Authentication and authorization ● LDAP integration ● End-point access controls ● Rate limiting API Management
No SSL My App http://myapp.mydomain.com Router My App My App
Edge Termination My App https://myapp.mydomain.com Router My App My App
Passthrough Termination My App https://myapp.mydomain.com Router My App My App
Reencrypt Termination My App https://myapp.mydomain.com Router My App My App
Secrets Sensitive Info: Passwords, Client Config files, dockercfg etc used by application containers provided as secrets Never come to rest on Nodes Stored in ETCD. Encrypted starting OCP 3.6.1 kubernetesMasterConfig: apiServerArguments: experimental-encryption-provider-config: - /path/to/encryption.config
47 Calling External Services using Egress Router The OpenShift egress router runs a service that redirects egress pod traffic to one or more specified remote servers, using a pre-defined source IP address that can be whitelisted on the remote server. NODE IP1 EGRESS ROUTER POD IP1 EGRESS SERVICE INTERNAL-IP:8080 EXTERNAL SERVICE Whitelist: IP1 POD POD POD ... - name: EGRESS_DESTINATION value: | 80 tcp 1.2.3.4 8080 tcp 5.6.7.8 80 8443 tcp 9.10.11.12 443 13.14.15.16 ...
Signing GPG Keyring policy.json Signed OpenShift Node OpenShift Registry image-auditor role gpg2 --gen-key atomic push --sign-by oc adm verify-image-signature Cluster Admin Unsecure Container Ansible for Key Propagation OpenShift Node Tenant Select from Content imageStreams templates images if/then sandboxProject productionProject nodeLabelSelector nodeLabelSelector 1 2 3 1 Tenant Usage Steps Cluster Admin Setup Steps 2 3 Upcoming!!
Thank you!!

More Related Content

PDF
Docker London: Container Security
Phil Estes
 
PDF
How Secure Is Your Container? ContainerCon Berlin 2016
Phil Estes
 
PDF
Open Source Tools for Container Security and Compliance @Docker LA Meetup 2/13
Zach Hill
 
PDF
Docker Security: Are Your Containers Tightly Secured to the Ship?
Michael Boelen
 
PDF
Ten layers of container security for CloudCamp Nov 2017
Gordon Haff
 
PDF
Docker security introduction-task-2016
Ricardo Gerardi
 
PPT
Container security
Anthony Chow
 
PDF
Tokyo OpenStack Summit 2015: Unraveling Docker Security
Phil Estes
 
Docker London: Container Security
Phil Estes
 
How Secure Is Your Container? ContainerCon Berlin 2016
Phil Estes
 
Open Source Tools for Container Security and Compliance @Docker LA Meetup 2/13
Zach Hill
 
Docker Security: Are Your Containers Tightly Secured to the Ship?
Michael Boelen
 
Ten layers of container security for CloudCamp Nov 2017
Gordon Haff
 
Docker security introduction-task-2016
Ricardo Gerardi
 
Container security
Anthony Chow
 
Tokyo OpenStack Summit 2015: Unraveling Docker Security
Phil Estes
 

What's hot (20)

PDF
DockerCon EU 2015: Docker and PCI-DSS - Lessons learned in a security sensiti...
Docker, Inc.
 
PDF
Container Security
Salman Baset
 
PDF
Docker Security Paradigm
Anis LARGUEM
 
PPTX
Container security
Anthony Chow
 
PDF
Rooting Out Root: User namespaces in Docker
Phil Estes
 
PPTX
Docker Security Overview
Sreenivas Makam
 
PDF
Docker Security in Production Overview
Delve Labs
 
PDF
DockerCon SF 2015: Docker Security
Docker, Inc.
 
PDF
Docker Security - Continuous Container Security
Dieter Reuter
 
PPTX
Oscon London 2016 - Docker from Development to Production
Patrick Chanezon
 
PPTX
Understanding container security
John Kinsella
 
PDF
Docker Security and Content Trust
ehazlett
 
PPTX
A Survey of Container Security in 2016: A Security Update on Container Platforms
Salman Baset
 
PDF
The Golden Ticket: Docker and High Security Microservices by Aaron Grattafiori
Docker, Inc.
 
PDF
Docker, Linux Containers (LXC), and security
Jérôme Petazzoni
 
PDF
Docker and kernel security
smart_bit
 
PDF
DockerCon EU 2015: Shipping Manifests, Bill of Lading and Docker Metadata and...
Docker, Inc.
 
PPTX
Docker 1.11 Presentation
Sreenivas Makam
 
PDF
Docker security: Rolling out Trust in your container
Ronak Kogta
 
PDF
runC: The little engine that could (run Docker containers) by Docker Captain ...
Docker, Inc.
 
DockerCon EU 2015: Docker and PCI-DSS - Lessons learned in a security sensiti...
Docker, Inc.
 
Container Security
Salman Baset
 
Docker Security Paradigm
Anis LARGUEM
 
Container security
Anthony Chow
 
Rooting Out Root: User namespaces in Docker
Phil Estes
 
Docker Security Overview
Sreenivas Makam
 
Docker Security in Production Overview
Delve Labs
 
DockerCon SF 2015: Docker Security
Docker, Inc.
 
Docker Security - Continuous Container Security
Dieter Reuter
 
Oscon London 2016 - Docker from Development to Production
Patrick Chanezon
 
Understanding container security
John Kinsella
 
Docker Security and Content Trust
ehazlett
 
A Survey of Container Security in 2016: A Security Update on Container Platforms
Salman Baset
 
The Golden Ticket: Docker and High Security Microservices by Aaron Grattafiori
Docker, Inc.
 
Docker, Linux Containers (LXC), and security
Jérôme Petazzoni
 
Docker and kernel security
smart_bit
 
DockerCon EU 2015: Shipping Manifests, Bill of Lading and Docker Metadata and...
Docker, Inc.
 
Docker 1.11 Presentation
Sreenivas Makam
 
Docker security: Rolling out Trust in your container
Ronak Kogta
 
runC: The little engine that could (run Docker containers) by Docker Captain ...
Docker, Inc.
 
Ad

Similar to Veer's Container Security (20)

PDF
Linux Containers and Docker SHARE.ORG Seattle 2015
Filipe Miranda
 
PDF
Security on a Container Platform
All Things Open
 
PDF
Securing Applications and Pipelines on a Container Platform
All Things Open
 
PDF
Securing Applications and Pipelines on a Container Platform
All Things Open
 
PPTX
Oscon 2017: Build your own container-based system with the Moby project
Patrick Chanezon
 
ODP
containerD
strikr .
 
PDF
Unraveling Docker Security: Lessons From a Production Cloud
Salman Baset
 
PDF
Dockers zero to hero
Nicolas De Loof
 
PPTX
Docker - Demo on PHP Application deployment
Arun prasath
 
PDF
Ivan Zhuravel and Ihor Khlaponin "DC/OS vs Kubernetes. Let the Fight Begin!"
LogeekNightUkraine
 
PDF
Revolutionizing the cloud with container virtualization
WSO2
 
PDF
Linux Container Technology inside Docker with RHEL7
Etsuji Nakai
 
PPT
Container security
Anthony Chow
 
PPTX
Cloud Security Hardening та аудит хмарної безпеки за допомогою Scout Suite
OWASP Kyiv
 
PPTX
Containers and workload security an overview
Krishna-Kumar
 
PDF
High%20Level%20-%20OpenShift%204%20Technical%20Deep%20Dive%20-%202024%20-%20I...
PutraChandra7
 
PPTX
Docker Azure Friday OSS March 2017 - Developing and deploying Java & Linux on...
Patrick Chanezon
 
PPTX
Docker containers introduction and its usage
saurabh22062
 
PPTX
Keystone - Openstack Identity Service
Prasad Mukhedkar
 
PDF
Beyond static configuration
Stefan Schimanski
 
Linux Containers and Docker SHARE.ORG Seattle 2015
Filipe Miranda
 
Security on a Container Platform
All Things Open
 
Securing Applications and Pipelines on a Container Platform
All Things Open
 
Securing Applications and Pipelines on a Container Platform
All Things Open
 
Oscon 2017: Build your own container-based system with the Moby project
Patrick Chanezon
 
containerD
strikr .
 
Unraveling Docker Security: Lessons From a Production Cloud
Salman Baset
 
Dockers zero to hero
Nicolas De Loof
 
Docker - Demo on PHP Application deployment
Arun prasath
 
Ivan Zhuravel and Ihor Khlaponin "DC/OS vs Kubernetes. Let the Fight Begin!"
LogeekNightUkraine
 
Revolutionizing the cloud with container virtualization
WSO2
 
Linux Container Technology inside Docker with RHEL7
Etsuji Nakai
 
Container security
Anthony Chow
 
Cloud Security Hardening та аудит хмарної безпеки за допомогою Scout Suite
OWASP Kyiv
 
Containers and workload security an overview
Krishna-Kumar
 
High%20Level%20-%20OpenShift%204%20Technical%20Deep%20Dive%20-%202024%20-%20I...
PutraChandra7
 
Docker Azure Friday OSS March 2017 - Developing and deploying Java & Linux on...
Patrick Chanezon
 
Docker containers introduction and its usage
saurabh22062
 
Keystone - Openstack Identity Service
Prasad Mukhedkar
 
Beyond static configuration
Stefan Schimanski
 
Ad

Recently uploaded (20)

PDF
SAP S4 Hana Brochure 3 (PTS SYSTEMS AND SOLUTIONS)
pts464036
 
PDF
How Creative Agencies Leverage Project Management Software.pdf
Orangescrum
 
PDF
AI in Product Development-omnex systems
omnex systems
 
PDF
2025 Textile ERP Trends: SAP, Odoo & Oracle
Aetos Technologies
 
PDF
Wondershare Filmora 15 Crack With Activation Key [2025
ghrom2211g
 
PPTX
Oracle E-Business Suite: A Comprehensive Guide for Modern Enterprises
Conacent Consulting
 
PDF
Understanding Forklifts - TECH EHS Solution
TECH EHS Solution
 
PDF
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
Andre Kraus
 
PDF
Addressing The Cult of Project Management Tools-Why Disconnected Work is Hold...
OnePlan Solutions
 
PPTX
CHAPTER 12 - CYBER SECURITY AND FUTURE SKILLS (1) (1).pptx
AnujKumar530915
 
PDF
Design an Analysis of Algorithms II-SECS-1021-03
DilanEscobar1
 
PDF
How to Choose the Right IT Partner for Your Business in Malaysia
Asian Business Services & Technologies
 
PDF
Digital Strategies for Manufacturing Companies
Virendra Rai, PMP
 
PPTX
Lecture 3: Operating Systems Introduction to Computer Hardware Systems
hci7se
 
PPTX
Agentic AI : A Practical Guide. Undersating, Implementing and Scaling Autono...
IT IDOL Technologies
 
PDF
Which alternative to Crystal Reports is best for small or large businesses.pdf
Varsha Nayak
 
PDF
Audit Checklist Design Aligning with ISO, IATF, and Industry Standards — Omne...
rohnjim07
 
PPTX
Introduction to Artificial Intelligence
lohedi9363
 
PDF
Design an Analysis of Algorithms I-SECS-1021-03
DilanEscobar1
 
PDF
Internet Downloader Manager (IDM) Crack 6.42 Build 41
ghrom2211g
 
SAP S4 Hana Brochure 3 (PTS SYSTEMS AND SOLUTIONS)
pts464036
 
How Creative Agencies Leverage Project Management Software.pdf
Orangescrum
 
AI in Product Development-omnex systems
omnex systems
 
2025 Textile ERP Trends: SAP, Odoo & Oracle
Aetos Technologies
 
Wondershare Filmora 15 Crack With Activation Key [2025
ghrom2211g
 
Oracle E-Business Suite: A Comprehensive Guide for Modern Enterprises
Conacent Consulting
 
Understanding Forklifts - TECH EHS Solution
TECH EHS Solution
 
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
Andre Kraus
 
Addressing The Cult of Project Management Tools-Why Disconnected Work is Hold...
OnePlan Solutions
 
CHAPTER 12 - CYBER SECURITY AND FUTURE SKILLS (1) (1).pptx
AnujKumar530915
 
Design an Analysis of Algorithms II-SECS-1021-03
DilanEscobar1
 
How to Choose the Right IT Partner for Your Business in Malaysia
Asian Business Services & Technologies
 
Digital Strategies for Manufacturing Companies
Virendra Rai, PMP
 
Lecture 3: Operating Systems Introduction to Computer Hardware Systems
hci7se
 
Agentic AI : A Practical Guide. Undersating, Implementing and Scaling Autono...
IT IDOL Technologies
 
Which alternative to Crystal Reports is best for small or large businesses.pdf
Varsha Nayak
 
Audit Checklist Design Aligning with ISO, IATF, and Industry Standards — Omne...
rohnjim07
 
Introduction to Artificial Intelligence
lohedi9363
 
Design an Analysis of Algorithms I-SECS-1021-03
DilanEscobar1
 
Internet Downloader Manager (IDM) Crack 6.42 Build 41
ghrom2211g
 

Veer's Container Security

  • 1. @OpenShift RHOpenShift Container Security Presenter: Veer Muchandi Title: Principal Architect - Container Solutions Social Handle: @VeerMuchandi Blogs: https://blog.openshift.com/author/veermuchandi/
  • 2. What Are Containers? ● Sandboxed application processes on a shared Linux OS kernel ● Simpler, lighter, and denser than virtual machines ● Portable across different environments ● Package my application and all of its dependencies ● Deploy to any environment in seconds and enable CI/CD ● Easily access and share containerized components INFRASTRUCTURE APPLICATIONS It Depends on Who You Ask 2
  • 5. Container Host Security Linux Technologies - Namespaces for Isolation - Seccomp - Read Only Mounts - SELinux - MCS - RHEL Atomic Base Image build your applications - RHEL or RHEL-Atomic
  • 7. Kernel provides process isolation by creating separate namespaces for containers PID namespaces allow processes in different containers to have the same PID Network namespaces allows container to use separate virtual network stack, loopback device and process space Mount namespaces isolate the set of file system mount points UTS namespaces isolate system identifiers – nodename and domainname IPC namespaces isolate certain interprocess communication (IPC) resources User allow you to specify a range of host UIDs dedicated to the container. A process can have full root privileges for operations inside the container.
  • 8. Cgroups ensure that a single container cannot exhaust a large amount of system resources Cgroups allocate CPU time, system memory, network bandwidth, or combinations of these among user-defined groups of tasks
  • 9. 9 SELinux and Multi Category Security ● Mandatory Access Control ● SElinux is a LABELING system ● Every Process has a Label ● Every file, Directory, System object has a Label ● Policy rules control access between labeled processes and labeled objects ● The Kernel enforces the rules
  • 10. 10 SELINUX - MAC - MCS - Process system_u:system_r:container_runtime_t:s0 SElinux Policy module for the container The OOTB SElinux policy container.te defines what you can execute and access with the label container_runtime_t [root@osemaster ~]# ps -efZ | grep docker-containerd-shim-current system_u:system_r:container_runtime_t:s0 root 3035 1479 0 Feb15 ? 00:00:01 /usr/bin/docker-containerd-shim-current 4d254785cbc6ee7aae8facc48555251e2385f65d89553b319b6324b1501e4b16 /var/run/docker/libcontainerd/4d254785cbc6ee7aae8facc48555251e2385f65d89553b319b6324b1501e4b16 /usr/libexec/docker/docker-runc-current
  • 11. 11 SELINUX - MAC - MCS - Files container_var_lib_t / svirt_sandbox_file_t SElinux Policy module for the container [root@osemaster ~]# ls -lZ /var/lib/docker/containers/97de4217a04b6532e312cfb3e4638529aeb7dfa281a2cc067e092fcee82e6737 / -rw-r-----. root root system_u:object_r:container_var_lib_t:s0 97de4217a04b6532e312cfb3e4638529aeb7dfa281a2cc067e092fcee82e6737-json.log -rw-rw-rw-. root root system_u:object_r:container_var_lib_t:s0 config.v2.json -rw-rw-rw-. root root system_u:object_r:container_var_lib_t:s0 hostconfig.json -rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0 hostname -rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 hosts -rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0 resolv.conf -rw-r--r--. root root system_u:object_r:container_var_lib_t:s0 resolv.conf.hash drwxr-xr-x. root root system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 secrets drwx------. root root system_u:object_r:container_var_lib_t:s0 shm
  • 12. 12 SECCOMP - DROPPING PRIVILEGES FROM CONTAINERS CAP_SETPCAP CAP_SYS_MODULE CAP_SYS_RAWIO CAP_SYS_PACCT CAP_SYS_NICE CAP_SYS_RESOURCE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_AUDIT_WRITE CAP_AUDIT_CONTROL CAP_MAC_OVERRIDE CAP_MAC_ADMIN CAP_SYSLOG CAP_NET_ADMIN CAP_SYS_ADMIN Modify process capabilities Insert/Remove kernel modules Modify Kernel Memory Configure process accounting Modify Priority of processes Override Resource Limits Modify the system clock Configure tty devices Write the audit log Configure Audit Subsystem Ignore Kernel MAC Policy Configure MAC Configuration Modify Kernel printk behaviour Configure the network: - Setting the hostname/domainname - mount(),unmount() - nfsservctl - ….
  • 13. 13 SECCOMP - REMOVE PRIVILEGES FROM CONTAINERS A root user inside a container running in OpenShift has none of the previous capabilities available!
  • 15. Container Build Time Security - Content in the containers, Trusted Containers - Responsibility of maintaining Container Images - Container Registry - RBAC, Public and Private Registries - Scanning for Vulnerabilities - Integrating Container Scanning and SAST into CI/CD - Future Vulnerabilities - Build Automation to rebuild during fixes
  • 16. ● Red Hat Container Registry ● Policies to control who can deploy which containers ● Certification Catalog ● Trusted content with security updates HOST OS CONTAINER OS RUNTIME APP HOST OS CONTAINER OS RUNTIME APP 16 Image governance and private registries ● What security meta-data is available for your images? ● Are the images in the registry updated regularly? ● Are there access controls on the registry? How strong are they? Trusting Container Content
  • 17. Red Hat provides Trusted Container Images (registry.access.redhat.com) Languages: PHP, Python, Ruby, Perl, Node.js, Java, .Net Core Enterprise Grade JBoss Middleware: EWS, EAP, BPM, BRMS, RH SSO, Data Grid, DataVirt, 3Scale Databases: MySQL, Mongo, PostgreSQL, Maria CICD: Jenkins Partners Images: Container Certification by Red Hat. Publish fixes to the content in this registry and notify you.
  • 18. 18 Red Hat Registry: Container Health Index https://access.redhat.com/articles/2803031
  • 19. Private Registries What if public registry (like DockerHub) is down? Enterprise security policies may not allow your Container Images to be pushed outside. Caching images in Private Registry - Atomic Registry with RBAC - JFrog Artifactory - Docker Trusted Registry
  • 20. 20 RESTRICT WHERE YOUR CONTAINERS COME FROM - name: allow-images-from-internal-registry onResources: - resource: pods - resource: builds matchIntegratedRegistry: false - name: allow-images-from-dockerhub onResources: - resource: pods - resource: builds matchRegistries: - docker.io
  • 21. Responsibilities in the new paradigm Operations - Maintain Trusted OS Base Images (RHEL, RHEL-Atomic) - Ensure these are good with Linux Kernel System Engineers/Architects - Maintain Middleware Images - Control build process - S2I, CICD - Reference Architectures with Trusted middleware Development teams - Write code that layers on approved images - Ensure code is clean, opensource software vullnerabilities are handled
  • 22. Container Scanning Frequency Scan containers as soon as they are created Scan containers that get into registry Ongoing basis- Identify any new vulnerabilities “Deny execution of containers that are vulnerable”
  • 23. 23 Scanning containers when created https://www.youtube.com/watch?v=65BnTLcDAJI Run the scan at this point
  • 24. Scanning Tools Atomic Scan - configurable with different scanners OpenScap Scanner - also built into CloudForms BlackDuck JFrog XRay
  • 25. 25 Identify Vulnerabilites on an ongoing basis
  • 28. 28 Build Automation - when there are updated images
  • 29. Container Platform Security - Authentication - Authorization - Running Privileged Containers - Network Isolation - Securing communication between hosts - Storage Security - Deploying workloads to specific hosts of your choice
  • 30. API Authentication • OAuth Access Token – Obtained from OAuth server using endpoints – Sent as • X.509 Client Certs – HTTPS connection – API Server verifies against a trusted cert authority bundle – API Server creates and distributes certs to Controllers to authenticate themselves • Request with invalid token or cert gets a 401 • No cert or token gets system:anonymous user and system: unauthenticated virtual group <master>/oauth/authorize <master>/oauth/token Authorization: Bearer access_token=…​
  • 31. Authentication OAuth Client OAuth Server Master Client Types: openshift-web-console openshift-browser-client openshift-challenging-client Identity Provider 1. Authentication Request 2. Determine Identity 3. Access token Configured Identity Providers: - LDAP - GitHub - GitLab - Google - OpenID Connect - HTPasswd Authentication Requests: <master>/oauth/authorize WWW-authenticate <master>/oauth/token/request
  • 32. Authorization RoleBinding associates Users/Groups with Roles - Cluster RoleBindings - Project RoleBindings
  • 34. Network Isolation with Network Policy Objects Add Network Policies To Allow Specific Incoming Traffic
  • 35. 35 Secured Communications between Hosts Secures cluster communications with IPsec ● Encryption between all Master and Node hosts (L3) ● Uses OpenShift CA and existing certificates ● Simple setup via policy defn ○ Groups (e.g. subnets) ○ Individual hosts Master P1 Nodes P2 172.16.0.0/16
  • 36. 36 Secure storage by using ● SELinux access controls ● Secure mounts ● Supplemental group IDs for shared storage Securing Storage attached to Containers
  • 37. 37 Isolate Workloads by labeling Nodes Node 1 east Node 2 east Node 1 west Node 2 west Master / Scheduler $ oadm new-project myproject --node-selector='type=user-node,region=east' pod pod
  • 38. 38 Securing federated clusters across data centers or environments ● Authentication and authorization ● API endpoints ● Secrets ● Namespaces FEDERATED CLUSTERS (Roadmap) ROLES & ACCESS MANAGEMENT Source: Building Globally Distributed Services using Kubernetes Cluster Federation. October 14, 2016
  • 39. 39 FEDERATED CLUSTERS (Roadmap) ROLES & ACCESS MANAGEMENT Source: Building Globally Distributed Services using Kubernetes Cluster Federation. October 14, 2016 API Repl Ctrl Ubernetes state API Repl Ctrl Kubernetes Cluster state API Repl Ctrl Kubernetes Cluster state
  • 40. Application Security - Running as Containers - API Management - Red Hat Single Sign-on - HTTP(s) - Securing sensitivedata as Secrets - Calling services running outside a Container Platform
  • 41. 41 Container platform & application APIs ● Authentication and authorization ● LDAP integration ● End-point access controls ● Rate limiting API Management
  • 46. Secrets Sensitive Info: Passwords, Client Config files, dockercfg etc used by application containers provided as secrets Never come to rest on Nodes Stored in ETCD. Encrypted starting OCP 3.6.1 kubernetesMasterConfig: apiServerArguments: experimental-encryption-provider-config: - /path/to/encryption.config
  • 47. 47 Calling External Services using Egress Router The OpenShift egress router runs a service that redirects egress pod traffic to one or more specified remote servers, using a pre-defined source IP address that can be whitelisted on the remote server. NODE IP1 EGRESS ROUTER POD IP1 EGRESS SERVICE INTERNAL-IP:8080 EXTERNAL SERVICE Whitelist: IP1 POD POD POD ... - name: EGRESS_DESTINATION value: | 80 tcp 1.2.3.4 8080 tcp 5.6.7.8 80 8443 tcp 9.10.11.12 443 13.14.15.16 ...
  • 48. Signing GPG Keyring policy.json Signed OpenShift Node OpenShift Registry image-auditor role gpg2 --gen-key atomic push --sign-by oc adm verify-image-signature Cluster Admin Unsecure Container Ansible for Key Propagation OpenShift Node Tenant Select from Content imageStreams templates images if/then sandboxProject productionProject nodeLabelSelector nodeLabelSelector 1 2 3 1 Tenant Usage Steps Cluster Admin Setup Steps 2 3 Upcoming!!