Abstract:Linux containers have recently gained more popularity as an operating system level virtualization approach for running multiple isolated OS distros on a control host or deploying large scale microservice-based applications in the cloud environment. The wide adoption of containers as an application deployment platform also attracts attackers’ attention. Since the system calls are the entry points for processes trapping into the kernel, Linux seccomp filter has been integrated into popular container management tools such as Docker to effectively constrain the system calls available to the container. However, Docker lacks a method to obtain and customize the set of necessary system calls for a given application. Moreover, we observe that a number of system calls are only used during the short-term booting phase and can be safely removed from the long-term running phase for a given application container. In this paper, we propose a container security mechanism called SPEAKER that can dramatically reduce the number of available system calls to a given application container by customizing and differentiating its necessary system calls at two different execution phases, namely, booting phase and running phase. For a given application container, we first separate its execution into booting phase and running phase and then trace the invoked system calls at these two phases, respectively. Second, we extend the Linux seccomp filter to dynamically update the available system calls when the application is running from the booting phase into the running phase. Our mechanism is non-intrusive to the application running in the container. We evaluate SPEAKER on the popular web server and data store containers from Docker hub, and the experimental results show that it can successfully reduce more than 50% and 35% system calls in the running phase for the data store containers and the web server containers, respectively, with negligible performance overhead.

Zero-consistency root emulation for unprivileged container image build

Houdini's Escape

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

Condo: Enhancing Container Isolation Through Kernel Permission Data Protection

SPEAKER: Split-Phase Execution of Application Containers

Practical and Effective Sandboxing for Linux Containers

RSDS: Getting System Call Whitelist for Container Through Dynamic and Static Analysis

Lic-Sec: An enhanced AppArmor Docker security profile generator

Container-Ima: A Privacy-Preserving Integrity Measurement Architecture For Containers

Cabin: Confining Untrusted Programs within Confidential VMs

Idiomatic and Reproducible Software Builds using Containers for Reliable Computing

Mining Sandboxes for Linux Containers

Docker container hardening method based on trusted computing

BPFContain: Fixing the Soft Underbelly of Container Security

Towards Understanding and Defeating Abstract Resource Attacks for Container Platforms

DirtyCred: Escalating Privilege in Linux Kernel

Parma: Confidential Containers via Attested Execution Policies

H-Container: Enabling Heterogeneous-ISA Container Migration in Edge Computing

SysCap: Profiling and Crosschecking Syscall and Capability Configurations for Docker Images

The Road to Trust: Building Enclaves within Confidential VMs