Aqua Blog

Docker Security

A Security Review of Docker Official Images: Which Do You Trust?

A Security Review of Docker Official Images: Which Do You Trust?

A key element in building secure containerized applications is to ensure that the base image that you use is well-maintained and secure. A common piece of advice is to use the Docker Official Images for this purpose. However, our research reveals that you need to be careful when using these images, as some are no …

Continue reading ›
Top 22 Docker Security Best Practices: Ultimate Guide

Top 22 Docker Security Best Practices: Ultimate Guide

While Docker has become synonymous with containers, various container tools and platforms have emerged to make the process of developing and running containers more efficient. Still, a lot of the same principles around Docker security apply for protecting container-based applications built with other tools as well. We …

Continue reading ›
The Challenges of Uniquely Identifying Your Images

The Challenges of Uniquely Identifying Your Images

One of the challenges of container security is ensuring that the image you’re getting is exactly what you expect it to be. Both from a security and consistency perspective, it’s important to ensure there are no surprises in what you’re downloading. Docker image tags, whilst convenient, can’t always be relied on to …

Continue reading ›
Threat Alert: Maneuver Docker API for Host Takeover

Threat Alert: Maneuver Docker API for Host Takeover

Docker clients can communicate with the daemon either locally, via a unix socket, or over a network via a TCP socket. Aqua's research team discovered an interesting attack vector running on top of an unsecured Docker socket API. Instead of running a malicious Docker image, the attacker changes the traditional …

Continue reading ›
Building IoT Applications with Containers

Building IoT Applications with Containers

At DockerCon earlier this month, Docker and Arm announced a joint venture in which new Docker-based solutions will be available to the Arm ecosystem. Docker and Arm touted this synergy as a way for developers to leverage containers, both remote and on-premises, in an easier way. There will be a common software …

Continue reading ›
CVE-2019-5021: Alpine Docker Image ‘null root password’ Vulnerability

CVE-2019-5021: Alpine Docker Image ‘null root password’ Vulnerability

A new vulnerability that impacts Alpine Docker images was published last week. The vulnerability is due to the ‘root’ user password which is set, by default, to NULL on Alpine Docker images from version 3.3 or higher.

Continue reading ›
Docker Hub Unauthorized Access Incident: What You Should Know

Docker Hub Unauthorized Access Incident: What You Should Know

A few days ago, Docker discovered that a database holding the credentials of some 190,000 Docker Hub accounts was exposed to unauthorized access (about 5% of all Docker Hub accounts). We’ve been getting questions from customers on this, so I wanted to set the record straight on what we know and what we recommend doing.

Continue reading ›
Mitigating High Severity RunC Vulnerability (CVE-2019-5736)

Mitigating High Severity RunC Vulnerability (CVE-2019-5736)

Yesterday it was disclosed that a new high severity (CVSS score 7.2)vulnerability (CVE-2019-5736) was found in runc, that allows an attacker to potentially compromise the container host.Patches are already available from most providers (see below). Aqua customers can also prevent this vulnerability from being …

Continue reading ›
Aqua MicroScanner: Free Image Vulnerability Scanning Plugin for Jenkins

Aqua MicroScanner: Free Image Vulnerability Scanning Plugin for Jenkins

A few weeks ago we released Aqua MicroScanner, a free vulnerability scanner that you can embed into the dockerfile and automate scanning during image build.

Continue reading ›
"Jack-in-the-Box" Vulnerability When Unpacking Images (CVE-2018-8115)

"Jack-in-the-Box" Vulnerability When Unpacking Images (CVE-2018-8115)

Last week, Michael Hanselmann published details of a remote code execution vulnerability (CVE-2018-8115) that impacts Docker for Windows. As he described it: “Docker for Windows uses the Windows Host Compute Service Shim published and maintained by Microsoft. Its use of Go's “filepath.Join” function with unsanitized …

Continue reading ›
Popular Docker Networking and Kubernetes Networking Tools

Popular Docker Networking and Kubernetes Networking Tools

In a previous post, we explored six tools for storing data for Docker containers. Another challenge in container environments is getting containers to network in a consistent and secure manner - especially as container workloads may appear on different hosts as applications scale out, then disappear when they’re not …

Continue reading ›