search

OWASP / Docker-Security

Getting a handle on container security
https://owasp.org/www-project-docker-top-10/
Other
625 stars 130 forks source link

draft for the intro section of D06 [WIP] #38

Open drwetter opened 3 years ago

Aut0R3V commented 3 years ago

This looks great. @drwetter can you give me a brief idea on what you're expecting for the "How Do I Prevent" section? Maybe I can put in some work there

drwetter commented 3 years ago

This looks great. @drwetter can you give me a brief idea on what you're expecting for the "How Do I Prevent" section? Maybe I can put in some work there

I think it is smarter to start with other sections like 'Threat scenarios' and ' How can I find out?'. 'How do I prevent' is then the result of both.

Abusing ENV is a typical point. Bad examples for this and others are helpful.

Aut0R3V commented 3 years ago

This looks great. @drwetter can you give me a brief idea on what you're expecting for the "How Do I Prevent" section? Maybe I can put in some work there

I think it is smarter to start with other sections like 'Threat scenarios' and ' How can I find out?'. 'How do I prevent' is then the result of both.

Abusing ENV is a typical point. Bad examples for this and others are helpful.

Sure thanks

kamadorueda commented 3 years ago

Hi, can we merge pull requests on a regular basis? This way other people could collaborate on building the same document without too much conflicts

By the way, I've found these to be sources of secrets leakage:

image

The last one's threat is when an attacker has access to stopped containers in the host, for instance in shared CI systems

drwetter commented 3 years ago

@kamadorueda : This PR is still open because it is not yet complete.

Yes, passing by env is a common mistake.

kamadorueda commented 3 years ago

@drwetter I just wanted to help writing a few sections

lirantal commented 3 years ago

Indeed. And, infact, I wrote in the Node.js version of the secure docker image building how to use secrets to properly pass secrets to images: https://cheatsheetseries.owasp.org/cheatsheets/NodeJS_Docker_Cheat_Sheet.html

drwetter commented 3 years ago

Thanks!

Github works with PRs as you probably know. :-) If you want something to be added which would be appreciated, please submit a PR. I clarified the structure of the ten points in the contribution guidelines and in the introduction which hopefully clarifies how it should look like.

For this specific point it should work if your PR is against the d06_intro branch. Otherwise I can open a dev branch and let things mature there. Let me know how we can work on this

@lirantal : I got a 404.

lirantal commented 3 years ago

@drwetter here it is: https://cheatsheetseries.owasp.org/cheatsheets/NodeJS_Docker_Cheat_Sheet.html

drwetter commented 3 years ago

Okay thanks. Basically one has to go through this and add commits hereto (by "hereto" I don't mean necessarily D06 only. A helping hand for the broader scope would be great.

In general what I would suggest that is that I either create a dev branch where all commits which a development status can be merged into. Alternatively I create separate dev branches for each open Dxx item. Both would ease progress)

Pls let me what you think.