Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Making Containers More Isolated: An Overview of Sandboxed Container Technologies

Summary: Unit 42 notes that traditional containers such as Docker, LXC, and rkt are not truly sandboxed because they share the host OS kernel, and that CVE-2014-3519, CVE-2016-5195, CVE-2016-9962, CVE-2017-5123, and CVE-2019-5736 can all lead to container breakout. The blog reviews four projects that re-architect container isolation: IBM Nabla on unikernels, Google gVisor with a user-space guest kernel, Amazon Firecracker as a lightweight hypervisor, and OpenStack placing containers in a container-optimized VM.

What you should know: Namespace and cgroup isolation leaves a weaker trust boundary than a VM, so a single kernel exploit or a container deployed with CAP_SYS_ADMIN or a mounted /var/run/docker.sock can put every co-located tenant in a multi-tenant cluster at risk.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related