Container Security Language

Root-in-container amplifies the blast radius of any application vulnerability.

Running as root inside a container is risky because:
1. If the application is compromised, the attacker has unlimited filesystem and process permissions within the container
2. Some escape vulnerabilities (e.g., runc CVE-2019-5736) are more dangerous when the attacker-controlled process is already root
3. Volume-mounted host paths are accessible with full root permissions
4. In privileged mode or with shared namespaces, container root effectively becomes host root

The fix: add RUN adduser --disabled-password --uid 1000 appuser and USER appuser before the ENTRYPOINT. For port 80/443, use CAP_NET_BIND_SERVICE or a reverse proxy instead of running as root.

Key vocabulary:
• UID 0 — root user; has unrestricted permissions within the container's filesystem and namespace
• USER instruction — Dockerfile instruction that sets the running user for subsequent RUN, CMD, and ENTRYPOINT
• privilege escalation — gaining higher permissions than initially granted (e.g., container root → host root)
• defence-in-depth — layered security so a single failure doesn't lead to full system compromise
• non-root user — a container user with UID > 0 and no elevated kernel privileges

Dropping all capabilities and re-granting only what's needed is the gold standard for container hardening.

Linux capabilities are a fine-grained breakdown of root's privilege set. Docker's default capability set includes many capabilities that most applications don't need:
• CAP_SYS_ADMIN — near-root; can mount filesystems, set resource limits, etc.
• CAP_NET_RAW — can craft raw packets; enables ARP spoofing and network sniffing
• CAP_CHOWN — can change file ownership

Starting from --cap-drop ALL and adding back only NET_BIND_SERVICE (which allows binding to ports < 1024) leaves the container's root user with virtually no dangerous kernel powers — even if the process is running as root.

Key vocabulary:
• Linux capability — a granular subdivision of root's privilege set; e.g., CAP_NET_ADMIN, CAP_SYS_ADMIN
• --cap-drop ALL — Docker flag removing all capabilities from the container's effective set
• --cap-add — Docker flag granting a specific capability back after dropping
• CAP_NET_BIND_SERVICE — capability allowing a process to bind to privileged network ports (< 1024)
• least-privilege — the security principle of granting only the minimum permissions required for a task

Professional vulnerability reporting is specific, actionable, and includes a verification step.

The standard workflow for a CVE finding in a CI scan:
1. Identify — name the CVE ID, affected package, and severity
2. Communicate — concisely describe the finding and remediation plan
3. Remediate — update the vulnerable base image or package
4. Verify — rebuild and rescan to confirm the CVE is gone
5. Document — record the fix in the PR or changelog

Vague escalation (A) or "emergency freeze" (B) adds unnecessary noise. Suppressing a CRITICAL finding (D) without documented risk assessment is a security anti-pattern and can violate compliance requirements.

Key vocabulary:
• CVE — Common Vulnerabilities and Exposures; a standardised identifier for a specific security vulnerability
• CRITICAL — the highest CVE severity; high exploitability or major data-confidentiality impact
• remediation — fixing the vulnerability by updating the affected component
• deployment gate — a CI/CD check that blocks deployment until security or quality criteria are met
• rescan — re-running the image scanner post-remediation to confirm the vulnerabilities are resolved

Seccomp filters system calls at the kernel boundary — a different layer from capabilities.

Seccomp (Secure Computing Mode) works at the boundary between user space and the Linux kernel. Every action an application takes eventually becomes a kernel system call (open, read, write, connect, clone, etc.). A seccomp profile written in BPF (Berkeley Packet Filter) bytecode specifies which syscalls are permitted; all others are blocked with EPERM or cause the process to be killed.

Docker's default seccomp profile blocks ~44 dangerous syscalls (including ptrace, reboot, mount, unshare) while allowing the ~300+ needed for normal operation. A custom, stricter profile reduces the attack surface further for high-risk containers.

Seccomp is complementary to capabilities: capabilities restrict what root can do at a coarse level; seccomp restricts which specific kernel functions any process (root or not) can invoke.

Key vocabulary:
• seccomp — Secure Computing Mode; Linux kernel mechanism for filtering system calls
• syscall (system call) — a request from user-space code to the kernel (e.g., open, write, connect)
• seccomp profile — a JSON/BPF ruleset defining which syscalls are permitted for a container
• attack surface — the set of entry points through which an attacker can attempt exploitation
• BPF — Berkeley Packet Filter; the low-level kernel bytecode used to implement seccomp rules

A read-only root filesystem prevents an attacker from establishing persistence inside the container.

If an attacker achieves remote code execution inside a container with a writable filesystem, they can:
• Modify application binaries or configuration
• Write web shells, reverse shell scripts, or cron jobs
• Persist across container restarts via volume-backed paths

With --read-only, none of these are possible — any write attempt fails. The application's legitimate write needs (temp files, PID files, Unix sockets) are served by tmpfs mounts at specific paths. tmpfs is an in-memory filesystem: writes succeed at runtime but are lost when the container stops — no persistence.

This is a standard CIS Docker Benchmark Level 1 recommendation and is complementary to running as a non-root user.

Key vocabulary:
• --read-only — Docker flag mounting the container root filesystem as read-only
• tmpfs — in-memory filesystem; writes are not persisted to disk and disappear when the container stops
• persistence — an attacker's ability to survive container restarts via filesystem changes
• CIS Docker Benchmark — security configuration guidelines for Docker published by the Center for Internet Security
• attack surface reduction — minimising the number of ways an attacker can exploit or persist in a system

This warning points to the significant risk of 'host networking,' where a container directly uses its host machine's network interface. This bypasses Docker's isolation mechanisms and allows the container to potentially access the host's network services without proper security controls like firewalls or network policies. While performance *can* be impacted, the primary concern is the increased attack surface – an attacker could leverage this direct connection for lateral movement within the infrastructure. Limiting networking to a virtual interface managed by Docker provides a much stronger layer of defense.

The primary security concern stems from using apt-get update. This command downloads package lists from repositories – these lists *themselves* can contain vulnerabilities if they haven't been updated recently and are susceptible to exploitation. While running `apt-get update` isn't inherently malicious, it's a critical step that introduces the potential for using vulnerable packages if not managed correctly. Options A and C incorrectly characterize the risk, while option D misattributes the vulnerability.

The primary risk is the bypassing of container security features and potential for arbitrary code execution. Directly executing a downloaded script, especially one obtained from an untrusted source like `https://example.com`, allows the script to run with the privileges of the container process—a major vulnerability. Containerization relies on sandboxing and controlled environments; this approach defeats that purpose by introducing an external, potentially compromised, command directly into the container's execution path.

Running container processes with elevated privileges via tools like `sudo` dramatically increases the potential impact of a security breach. If an attacker gains control of the entrypoint script, they can then leverage those root-level permissions to compromise the host system or other containers on the same network. This directly contradicts the principle of least privilege, which is fundamental to container security – the correct answer focuses on this high-impact vulnerability.

This warning points to the significant risk of 'host networking,' where a container directly uses its host machine's network interface. This bypasses Docker's isolation mechanisms and allows the container to potentially access the host's network services without proper security controls like firewalls or network policies. While performance *can* be impacted, the primary concern is the increased attack surface – an attacker could leverage this direct connection for lateral movement within the infrastructure. Limiting networking to a virtual interface managed by Docker provides a much stronger layer of defense.

The primary security concern stems from using apt-get update. This command downloads package lists from repositories – these lists *themselves* can contain vulnerabilities if they haven't been updated recently and are susceptible to exploitation. While running `apt-get update` isn't inherently malicious, it's a critical step that introduces the potential for using vulnerable packages if not managed correctly. Options A and C incorrectly characterize the risk, while option D misattributes the vulnerability.

The primary risk is the bypassing of container security features and potential for arbitrary code execution. Directly executing a downloaded script, especially one obtained from an untrusted source like `https://example.com`, allows the script to run with the privileges of the container process—a major vulnerability. Containerization relies on sandboxing and controlled environments; this approach defeats that purpose by introducing an external, potentially compromised, command directly into the container's execution path.

Running container processes with elevated privileges via tools like `sudo` dramatically increases the potential impact of a security breach. If an attacker gains control of the entrypoint script, they can then leverage those root-level permissions to compromise the host system or other containers on the same network. This directly contradicts the principle of least privilege, which is fundamental to container security – the correct answer focuses on this high-impact vulnerability.

This warning points to the significant risk of 'host networking,' where a container directly uses its host machine's network interface. This bypasses Docker's isolation mechanisms and allows the container to potentially access the host's network services without proper security controls like firewalls or network policies. While performance *can* be impacted, the primary concern is the increased attack surface – an attacker could leverage this direct connection for lateral movement within the infrastructure. Limiting networking to a virtual interface managed by Docker provides a much stronger layer of defense.

The primary security concern stems from using apt-get update. This command downloads package lists from repositories – these lists *themselves* can contain vulnerabilities if they haven't been updated recently and are susceptible to exploitation. While running `apt-get update` isn't inherently malicious, it's a critical step that introduces the potential for using vulnerable packages if not managed correctly. Options A and C incorrectly characterize the risk, while option D misattributes the vulnerability.

The primary risk is the bypassing of container security features and potential for arbitrary code execution. Directly executing a downloaded script, especially one obtained from an untrusted source like `https://example.com`, allows the script to run with the privileges of the container process—a major vulnerability. Containerization relies on sandboxing and controlled environments; this approach defeats that purpose by introducing an external, potentially compromised, command directly into the container's execution path.

Running container processes with elevated privileges via tools like `sudo` dramatically increases the potential impact of a security breach. If an attacker gains control of the entrypoint script, they can then leverage those root-level permissions to compromise the host system or other containers on the same network. This directly contradicts the principle of least privilege, which is fundamental to container security – the correct answer focuses on this high-impact vulnerability.

This warning points to the significant risk of 'host networking,' where a container directly uses its host machine's network interface. This bypasses Docker's isolation mechanisms and allows the container to potentially access the host's network services without proper security controls like firewalls or network policies. While performance *can* be impacted, the primary concern is the increased attack surface – an attacker could leverage this direct connection for lateral movement within the infrastructure. Limiting networking to a virtual interface managed by Docker provides a much stronger layer of defense.

The primary security concern stems from using apt-get update. This command downloads package lists from repositories – these lists *themselves* can contain vulnerabilities if they haven't been updated recently and are susceptible to exploitation. While running `apt-get update` isn't inherently malicious, it's a critical step that introduces the potential for using vulnerable packages if not managed correctly. Options A and C incorrectly characterize the risk, while option D misattributes the vulnerability.

The primary risk is the bypassing of container security features and potential for arbitrary code execution. Directly executing a downloaded script, especially one obtained from an untrusted source like `https://example.com`, allows the script to run with the privileges of the container process—a major vulnerability. Containerization relies on sandboxing and controlled environments; this approach defeats that purpose by introducing an external, potentially compromised, command directly into the container's execution path.

Running container processes with elevated privileges via tools like `sudo` dramatically increases the potential impact of a security breach. If an attacker gains control of the entrypoint script, they can then leverage those root-level permissions to compromise the host system or other containers on the same network. This directly contradicts the principle of least privilege, which is fundamental to container security – the correct answer focuses on this high-impact vulnerability.

Sarah raises a valid point about external dependencies. Pulling the latest package directly introduces a dependency on an external source that could be compromised. Option 2 correctly highlights the benefit of using the latest secure version while acknowledging Sarah's concern. Options 1 and 3 are incorrect because they either dismiss the vulnerability or suggest an inappropriate solution (pinned versions aren't always necessary).

Mark is highlighting a critical security risk. 'Host network mode' removes the container's isolation and allows the microservice to directly interact with the host machine's network. This bypasses the intended security benefits of containers, like network namespaces. Option 1 is too abstract; options 3 and 4 misrepresent the function or implications.

The use of `wget` and `bash` to execute a downloaded script introduces a significant command injection vulnerability. If the external script isn't carefully validated, an attacker could inject malicious commands into it. While options 2, 3 and 4 might be true in other contexts, they don't address the core security risk.

David's concern is justified. `chmod 777` grants unrestricted read, write, and execute permissions to all users on the system – a highly insecure practice that dramatically increases the risk of unauthorized access and potential security breaches. While file permissions are important, granting full access isn't necessary or secure.

The message highlights a critical security risk. Running a container in privileged mode grants it elevated privileges on the host system, potentially allowing it to execute commands with root access and compromise the entire host – a serious vulnerability. Options 1, 3 and 4 misrepresent the implications of privileged mode.