I want to attempt to increase the security of some Alpine Linux Docker containers which run Nginx and other servers.

I would like to disable commands like ls, cat, ed or sed, so that they are completely unavailable for users which manage to get access to a shell.

These commands should be available during Docker's build phase, it should be one last entry in the Dockerfile which removes these commands.

Would removing symlinks to /bin/busybox of the respective commands be enough? Could they somehow be recreated by a hacker?

  • 1
    If the users have root, which I'm assuming that they do in order to manage nginx and other servers, then there's nothing that you can do. Any restrictions that you could possibly put into place could simply be removed. Furthermore, there really isn't any sensible reason to remove commands like ls, cat, ed, and sed in this case as doing so would have no effect whatsoever on security. – Nasir Riley Aug 13 '18 at 0:23
  • 2
    This isn't really the right way to secure a Docker container. Many of these commands are necessary for the system inside to function. I'd start with this - docs.docker.com/engine/security/security. – slm Aug 13 '18 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.