3

Let's say that I have an Ubuntu host machine running Docker.

This host contains many running containers that use many various base images (FROM), such as ubuntu, alpine, java:8...

This host also contains some images built by hand.

Today, I am able to stop and remove all of my containers, then create all of them again. None of the images store data (I do not commit containers). Therefore losing my data is not an issue. Getting my services up again should not be an issue either as long as the images remain the same.

Assume a vulnerability has been found affecting the Linux Kernel.

I have updated my host OS so that the host is no longer vulnerable. Docker containers use the host's kernel to run, but is that enough? What are the considerations and actions I should take to make sure my containers are not affected by the vulnerability?

migrated from stackoverflow.com Nov 14 '16 at 11:35

This question came from our site for professional and enthusiast programmers.

  • @shellter I considered posting it on serverfault or security, but neither of them seemed appropriate (serverfault being for professionals, and security did not seem to be a good candidate for this). I did not consider superuser nor unix, I'm gonna see which of the two fits better. I chose stackoverflow because of the huge amount of questions that already exist on SO about docker, even though docker has nothing to do with programming unless it's used for continuous integration. – Hay Oct 22 '16 at 16:34
  • I feel your pain (and possible frustration). IMHO, S.O. so dwarfs the other sites, it would be better just to rely on tags to to filter by topic. I think I read there had been a VM test site but it didn't get enough traffic, so it has been dropped. The primary reason I voted to close is your problem is very broad and lacks a testable case. Can you make something in less than 1 page of code/scripts that people can replicate your problem? Good luck. – shellter Oct 22 '16 at 17:16
  • I disagree. Dockerfiles are written by programmers and they must consider security issues in their implementation. For example a simple upgrade at the top ensure us every time a container is built it has latests security patches in libraries – Carlos Rafael Ramirez Oct 22 '16 at 19:20
  • In my industry, adding automatic updates would get you fired (and you'd be firewalled from getting to the external internet anyway). ;-/ So as with most things in life, it depends. Also, this Q contained no code, so it didn't meet the expectations of stackoverflow.com/help/mcve . Thanks for your view! Good luck to all. – shellter Oct 22 '16 at 21:23
5

Since docker containers use the host kernel. Once the host kernel is updated you won't have problems with the containers.

Issues in libraries are another story. Openssl for example is a library which can be different in containers and the host and should be upgraded.

It is a good practice to include a apt-get update && apt-get -q -y upgrade at the top of your Dockerfile. So you should build your images regularly.

If you use official images it is good practice to make a pull regularly to upgrade your containers. If you use docker-compose:

docker-compose pull && docker-compose up -d

It will upgrade them. For plain docker you need to make a pull. Delete the container and create a newer one pointing to the same volumes:

docker pull image
docker stop containerid && docker rm containerid
docker run image ....

Regards

  • Got contraversial feelings on your answer. While your passage about kernel is definitely true, official images experience may vary (for not so mainstream images). apt update will likely fail in Dockerfile in this form – agg3l Oct 22 '16 at 23:16
  • It was just an example used with ubuntu:xenial, using it with other distributions may fail. And yes you should use only official base images, like centos or ubuntu – Carlos Rafael Ramirez Oct 23 '16 at 0:41
  • 1
    I will take note of DEBIAN_FRONTEND=noninteractive. I have without this. Although they don't fail in fact they emit some errors about terminals or something like that. – Carlos Rafael Ramirez Oct 23 '16 at 1:32
  • 1
    DEBIAN_FRONTEND vairiable adjustment is just another way to suspend useless apt non-interactive issues. Your initial proposal was apt upgrade AFAIR.. which triggered me to comment. You've fixed it since. We're done discussing it I hope, good luck to you – agg3l Oct 23 '16 at 1:36
  • 1
    I looked in my Dockerfiles and found the options. Same to you have a nice day / night – Carlos Rafael Ramirez Oct 23 '16 at 1:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.