Docker

Docker

• https://github.com/falcosecurity/falco-security-workshop

• https://cloudsecwiki.com/docker.html

• https://github.com/docker/docker-bench-security

• https://github.com/kost/dockscan

• https://www.sans.org/reading-room/whitepapers/auditing/checklist-audit-docker-containers-37437

• https://www.digitalocean.com/community/tutorials/how-to-audit-docker-host-security-with-docker-bench-for-security-on-ubuntu-16-04

• https://github.com/aquasecurity/trivy#vs-quay-docker-hub-gcr

• https://github.com/anchore/anchore-engine

• https://blog.aquasec.com/aqua-microscanner-free-image-vulnerability-scanning-plug-in-for-jenkins

• https://www.slideshare.net/jpetazzo/anatomy-of-a-container-namespaces-cgroups-some-filesystem-magic-linuxcon

• https://learnk8s.io/blog/smaller-docker-images - nice one

• https://stackoverflow.com/questions/16047306/how-is-docker-different-from-a-virtual-machine - **

• https://www.fosstechnix.com/docker-command-cheat-sheet/

Tools:

DAgda

Hadolint / Dockle

docker linter , https://github.com/docker-slim/docker-slim

Learning:

• Katacoda

• https://github.com/madhuakula/introduction-to-containers-using-docker/blob/master/workshop.md
• https://container.training/
• play with docker

Best Practices:

• https://www.reddit.com/r/docker/comments/9n9e73/the_three_container_security_golden_rules/
• https://www.reddit.com/r/devops/comments/9vc562/docker_security_best_practices_host_image_runtime/
• https://www.cisecurity.org/benchmark/docker/ - CIS Benchmark
• https://github.com/BretFisher/ama/issues/17?utm_campaign=FasterOps%3A%20Improving%20Your%20Container%20DevOps%20Skills&utm_medium=email&utm_source=Revue%20newsletter

Blogs:

• https://www.digitalocean.com/community/tutorials/how-to-audit-docker-host-security-with-docker-bench-for-security-on-ubuntu-16-04
• https://opensource.com/article/18/10/podman-more-secure-way-run-containers
• https://www.giantswarm.io/blog/building-container-images-with-podman-and-buildah
• https://medium.com/better-programming/what-goes-into-a-dockerfile-ff0ace591060
• https://www.practical-devsecops.com/author/secfigo/page/2/

For Practice:

• https://www.notsosecure.com/vulnerable-docker-vm/

Security

• https://aws.amazon.com/about-aws/whats-new/2019/10/announcing-image-scanning-for-amazon-ecr/
• https://blog.aquasec.com/docker-security-best-practices
• https://dev.to/petermbenjamin/docker-security-best-practices-45ih
• https://www.cs.ru.nl/bachelors-theses/2020/Joren_Vrancken___4593847___A_Methodology_for_Penetration_Testing_Docker_Systems.pdf
• https://dreamlab.net/en/blog/post/abusing-dockersock-exposure/
• https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/
• https://dejandayoff.com/the-danger-of-exposing-docker.sock/
• https://smart7.in/2021/01/30/Securing-Docker-From-Privilege-Escalation.html

Container Breakouts- https://blog.nody.cc/posts/container-breakouts-part1/

• https://i.blackhat.com/USA-20/Wednesday/us-20-Berta-Defending-Containers-Like-A-Ninja-A-Walk-Through-The-Advanced-Security-Features-Of-Docker-And-Kubernetes.pdf

https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/
https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/
https://capsule8.com/blog/practical-container-escape-exercise/
https://blog.pentesteracademy.com/abusing-sys-module-capability-to-perform-docker-container-breakout-cf5c29956edd?gi=d6343c6632fe

+https://ajxchapman.github.io/containers/2020/11/19/privileged-container-escape.html