Is my Container Secure? - Large-Scale Empirical Study on Container Vulnerabilities
No ratings
Presented at BlueHatShanghai 2019 by
Container, as a lightweight virtualization technique, enable enterprise to automate many aspects of web application deployment. No argue that, as the cornerstone of whole microservice ecosystem, container directly affects the quality and stability of all cloud-based applications, not to mention how important it is to secure your containers. As one of the most popular container implementation, Docker has been widely used in recent DevOps practice. When DevOps teams deploy their docker image by issuing simple commands, such as docker pull/push, people naturally start questioning: Is my downloaded image safe to deploy? Does it have any critical vulnerability? How to mitigate if vulnerability existed in my running container? In this talk, we attempt to answer these questions by reviewing the vulnerabilities discovered in popular docker images. In detail, we conduct a large scale empirical study on container images hosted on public docker repository. Our dataset includes over 40,000 individual images and, for each image, we collect their vulnerability information through multiple data sources, such as open source image scanner and online image analyzers. Through analyzing over 8,000 unique vulnerabilities found in these images, we discover interesting vulnerability evolution trends over time. Based on our knowledge, we also provide our explanation about these trends and forecast their change in the future. Last but not least, with the reference of our own vulnerability database, we hope to provide some important insights about these vulnerabilities. Some questions such as, Are these vulnerabilities exploitable in our container setup? and How to properly prioritize these vulnerabilities? , will be delicately discussed in this talk.