Container Security: Issues, Challenges, and the Road Ahead
Presented by Pramukh Prakash
Date: 25.09.2024
Table of Contents
1. Introduction
2. Threat Model and Use Case
3. Protection Mechanisms
4. Conclusion
Introduction
Hello everyone, my name is Pramukh Prakash, and today I'll be presenting on 'Container Security:
Issues, Challenges, and the Road Ahead.'
The presentation is based on a paper published in IEEE in April 2019 titled 'Container Security:
Issues, Challenges, and the Road Ahead,' written by Imtiaz Ahmed, Tassos Dimitriou, and Sari
Sultan. This paper has been cited 135 times, indicating its significance in the field of container
security.
In this presentation, I will guide you through the key aspects of container security, highlighting the
potential threats and protection mechanisms. Let's start with the threat models and use cases.
Threat Model and Use Cases
When it comes to container security, there are four primary areas of concern:
- Protecting containers from applications within them
- Inter-container protection
- Protecting the host from containers
- Protecting containers from the host
1. Protecting containers from applications inside them is crucial as these applications can be
semi-honest or malicious, potentially attacking the container or host system.
2. Inter-container protection ensures that one container cannot interfere with or attack another
container on the same host, which may include data theft or denial-of-service attacks.
3. Protecting the host from containers ensures that a potentially malicious container cannot harm or
compromise the host's security.
4. Finally, protecting containers from the host is important as an untrusted host could compromise
container confidentiality.
Now, let's look at the protection mechanisms available.
Protection Mechanisms
There are two broad categories of protection mechanisms: Software Protection and Hardware
Protection.
1. **Software Protection Mechanism**:
- Linux Kernel Features such as namespaces, control groups, capabilities, and secure computation
mode help in isolating resources, controlling access, and restricting system calls.
- Linux Security Modules (LSMs) like AppArmor and SELinux offer additional security setups and
customization.
2. **Hardware Protection Mechanism**:
- Virtual Trusted Platform Modules (vTPM) provide a virtual version of TPMs, offering a secure
method to handle encryption keys and secrets.
- Intel SGX utilizes secure enclaves to protect against potential attacks from a malicious kernel or
hypervisor.
These mechanisms play a significant role in mitigating threats to container security.
Conclusion
In conclusion, container security is of paramount importance in ensuring secure deployment in
modern computing environments. While existing protection mechanisms such as software and
hardware-based techniques provide a robust defense, there are still open challenges that need
addressing, including the exploration of container alternatives, enhancement of digital investigations,
and the development of container-specific Linux Security Modules.
Thank you for your attention, and I hope this presentation has offered valuable insights into
container security. I'm happy to take any questions you might have.
