CODEWITHSUNDEEP
securitydockercontainers
Max
Max

Reputation: 1292

Do we really need security updates on docker images

This question has come to my mind many times and I just wanted everyone to pitch in with their thoughts on same. The first thing that comes to my mind is container is not a VM and is almost equivalent to a process running in isolation in the host instance. Then why do we need to keep updating our docker images with security updates? If we have taken sufficient steps to secure our host instance then docker container should be safe. And even if we think from a different direction of multi layered security if the docker host is compromised then then there is no way to stop hacker from accessing all the containers running on the host; no matter how many security updates you did on the docker image. Are there any particular scenarios which anybody can share where security updates for docker images has really helped? Now I understand if somebody want's to update apache running in the container however are there reasons to do OS level security updates for images?

Upvotes: 2

Views: 710

Answers (1)

Thilo
Thilo

Reputation: 262534

  • an exploit can be dangerous even if it does not give you access to the underlying operating system. Just being able to do something within the application itself can be a big issue. For example, imagine you could inject scripts into Stackoverflow, impersonate other users, or obtain a copy of the complete user database.

  • just like any software, Docker (and the underlying OS-provided container mechanism) is not perfect and can also have bugs. As such, there may be ways to bypass the isolation and break out of the sandbox.

Upvotes: 3

Related Questions