A rather common insecure configuration for nginx allows for arbitrary code execution in the container. The compromise can extend beyond the container if docker's default capabilities are used. Let's see in practice how bad it can get if Linux capabilities are not carefully restricted for a container.
Kernel capabilities provide fine-grain control over system resources, allowing specific privileges without needing root access. Linux capabilities break up root permissions into small units to limit potential harm. Docker starts containers with a limited set of capabilities, offering reduced privileges compared to the host. Unnecessary capabilities in a container can increase the risk, so understanding and managing these is crucial for security.
Let’s head to the lab to discover, debug, and fix this vulnerability within an actual application.
Containers, protected by kernel features like cgroup and tools like AppArmor, do not offer the same protection as virtual machines. A compromised process in a container can be devastating, and since Docker engine and images often lack secure default settings, it is essential to take time to harden them.
