Docker
Packages an application and its dependencies into a container.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- App
- Framework
- Web Server
- Runtime
- ContainersDocker
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
Docker packages an application with everything it needs to run into a container, which starts in seconds. Containers share the host's kernel, usually Linux, so none of them runs a full operating system of its own. A container escape goes through that shared kernel or through the container runtime that sets containers up.
How to Spot It
These are signs that a system runs Docker, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Common port
2375 (Docker Engine API, unauthenticated)- Common port
2376 (Docker Engine API over TLS)
If It Has a Flaw
A container is only as separate as the kernel keeps it. A container escape reaches the host and every other container on it, so the kernel and the container runtime need their security updates promptly.
If Docker has a flaw, every container it runs on that host is exposed, with the app inside each and the data that app can reach. The apps and runtimes shown are exposed only where they run in its containers, not where they are installed straight on a server.
Well-Known Flaws
Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Docker sits.
CVE-2019-5736 (opens in a new tab)2019
runc Container Escape
A flaw in the runc container runtime let a container overwrite the host runtime and run code.
Reach It broke out of the container to the host that ran it.
Stacks and Code
Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- Its Code Comes From
Container Images