9

How do a prevent a user of my pre-built docker container from being able to access a shell within a running instance of that container? I have googled and read all the posts that are related to this scenario and have come up without a working solution. I am trying to prevent access to a given resource in the container, for the sake of this inquiry, let's say its a serial number in a configuration file. I am building upon the java:7 image which is based upon an ubuntu image.

To test your solution, do the following:

  1. Create and run your docker container

  2. Export your container

    docker export [container name] | gzip -c > mycontainer.tar.gz

  3. Import your container on an external system

    gzip -dc mycontainer.tar.gz | docker import - [container name]

  4. Run the container

  5. Shell into the running container using any / all of the following methods:

    docker exec -it [container name] bash

    docker attach [container name]

    docker run -ti --entrypoint=/bin/bash [container name]

[container name] is the name of your container

bash, dash, and sh are all valid shells

  • 1
    If you're trying to protect information inside of your container, docker is not the technology you want. Even if you were able to restrict shell access, there are a myriad of other trivial means to get access to the filesystem inside the container. – EEAA Sep 24 '15 at 13:59
  • Unfortunately I have to use docker in this instance; I am well aware that it is not ideal in this case. – Paul Gregoire Sep 24 '15 at 14:02
  • 1
    Hey @EEAA could you point me to a list of those "trivial means" ? What would you suggest instead of docker then ? – nils petersohn Jul 7 '19 at 21:44
5

For the bash command specifically, I added in the .bashrc file the command exit at the end of the file, so the user logs in and finally kicked out, but users still can use sh command.

3

To add on to Jose's answer, another solution is to...

docker exec :id -it /bin/rm -R /bin/*

That gets rid of sh and any bin useful command in linux. I'm unsure what you'd do to get into the container at that point. Though I know that you might be able to use a memory debugger to get environment variables of the running container, but it makes it that much more annoying... I wonder if theres a way to lock down that memory in ring 0 and take away ssh access altogether to the host.

If anyone knows how to crack that, I would be interested in knowing how.

EDIT

You want to use docker secrets if you're protecting sensitive information. Check out:

https://docs.docker.com/engine/swarm/secrets/

  • This works perfectly for my purposes, thanks! Although I believe the correct command is: docker exec -it 'container-id' /bin/rm -R /bin/* – ty01 Mar 11 '19 at 18:30
  • This does not work for me on Docker version 18.09.6, build 481bc77156 . The approach by @ty01 gives this error message /bin/rm: cannot remove '/bin/<filename>': No such file or directory for all filenames in /bin. The answer by @Dr. Knowitall returns Error: No such container: :id. Even if I replace id by the CONTAINER_ID from docker ps, it still gives the same error message. – edesz May 14 '19 at 19:03
0

If the information that you want to protect is a serial number, then encrypting that information is the only sure ways to protect it. You can choose various ways to encrypt secret data, make sure you are using a strong key. You can also make your application send secret data to your server to identify their validity and based on the replies from your server the apps can continue working or stop and show messages.

In a short way, always assume that your application can be dissected completely and thoroughly. Always encrypt all secret and important data using strong key so cracking the key will take very long time (assume that the encryption algorithm is publicly available or well known).

Preventing access alone even if you find a way to do it will just give a false sense of security.

  • 1
    ...then the secret to protect becomes the encryption key, and you need to protect it with an encryption key. And protect that key with a key and protect that key with a key and... – Mark Sep 12 '19 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.