Mixing
how to disallow docker cp option
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
0
I have a created a docker image for my running environment.
for some reason I need to put some encryption keys in the container since it requires it for it's operation .
is there some way I can block the option to execute docker cp and pull those keys?
thanks
docker
asked Jan 3 at 9:33
eran meirieran meiri
2961315
|
show 1 more comment
0
I have a created a docker image for my running environment.
for some reason I need to put some encryption keys in the container since it requires it for it's operation .
is there some way I can block the option to execute docker cp and pull those keys?
thanks
docker
asked Jan 3 at 9:33
eran meirieran meiri
2961315
how about encrypting them and reading them at runtime from memory
– v_sukt
Jan 3 at 11:48
please explain? where would I keep those keys?
– eran meiri
Jan 3 at 13:27
keep the encrypted one in image - which can be decrypted and moved the tmpfs at runtime (one can still copy if one knows the location inside the container) or read from the memory say like bash variable (if one knows the name one can use docker exec at runtime and print the value). So you can ask for decryption key at runtime - when container runs it'll ask for this first. [haven't used user input from ENTRYPOINT script - but should work normally when docker run is with -ti (terminal+interactive) options] - but you'll have to handle this in code for using it for TLS/SSL/smthng similar
– v_sukt
Jan 3 at 14:00
Or why don't you execute the package only if authenticated with some command-line argument?? - say ENTRYPOINT script manages authentication then does decryption on basis of that and then execute the decrypted section?? | don't know how one can manage this but there is something like docker-secrets (docs.docker.com/engine/swarm/secrets)
– v_sukt
Jan 3 at 14:05
regarding he first option , how will the encrypted key be decrypted? who will decrypt it? if I use and environment variable to hide the encryption key it will be visible via simple docker inspect command
– eran meiri
Jan 3 at 20:44
|
show 1 more comment
0
0
0
I have a created a docker image for my running environment.
for some reason I need to put some encryption keys in the container since it requires it for it's operation .
is there some way I can block the option to execute docker cp and pull those keys?
thanks
docker
asked Jan 3 at 9:33
eran meirieran meiri
2961315
I have a created a docker image for my running environment.
for some reason I need to put some encryption keys in the container since it requires it for it's operation .
is there some way I can block the option to execute docker cp and pull those keys?
thanks
docker
docker
asked Jan 3 at 9:33
eran meirieran meiri
2961315
asked Jan 3 at 9:33
eran meirieran meiri
2961315
asked Jan 3 at 9:33
eran meirieran meiri
2961315
asked Jan 3 at 9:33
eran meirieran meiri
2961315
asked Jan 3 at 9:33
eran meirieran meiri
2961315
2961315
how about encrypting them and reading them at runtime from memory
– v_sukt
Jan 3 at 11:48
please explain? where would I keep those keys?
– eran meiri
Jan 3 at 13:27
keep the encrypted one in image - which can be decrypted and moved the tmpfs at runtime (one can still copy if one knows the location inside the container) or read from the memory say like bash variable (if one knows the name one can use docker exec at runtime and print the value). So you can ask for decryption key at runtime - when container runs it'll ask for this first. [haven't used user input from ENTRYPOINT script - but should work normally when docker run is with -ti (terminal+interactive) options] - but you'll have to handle this in code for using it for TLS/SSL/smthng similar
– v_sukt
Jan 3 at 14:00
Or why don't you execute the package only if authenticated with some command-line argument?? - say ENTRYPOINT script manages authentication then does decryption on basis of that and then execute the decrypted section?? | don't know how one can manage this but there is something like docker-secrets (docs.docker.com/engine/swarm/secrets)
– v_sukt
Jan 3 at 14:05
regarding he first option , how will the encrypted key be decrypted? who will decrypt it? if I use and environment variable to hide the encryption key it will be visible via simple docker inspect command
– eran meiri
Jan 3 at 20:44
|
show 1 more comment
how about encrypting them and reading them at runtime from memory
– v_sukt
Jan 3 at 11:48
please explain? where would I keep those keys?
– eran meiri
Jan 3 at 13:27
keep the encrypted one in image - which can be decrypted and moved the tmpfs at runtime (one can still copy if one knows the location inside the container) or read from the memory say like bash variable (if one knows the name one can use docker exec at runtime and print the value). So you can ask for decryption key at runtime - when container runs it'll ask for this first. [haven't used user input from ENTRYPOINT script - but should work normally when docker run is with -ti (terminal+interactive) options] - but you'll have to handle this in code for using it for TLS/SSL/smthng similar
– v_sukt
Jan 3 at 14:00
Or why don't you execute the package only if authenticated with some command-line argument?? - say ENTRYPOINT script manages authentication then does decryption on basis of that and then execute the decrypted section?? | don't know how one can manage this but there is something like docker-secrets (docs.docker.com/engine/swarm/secrets)
– v_sukt
Jan 3 at 14:05
regarding he first option , how will the encrypted key be decrypted? who will decrypt it? if I use and environment variable to hide the encryption key it will be visible via simple docker inspect command
– eran meiri
Jan 3 at 20:44
how about encrypting them and reading them at runtime from memory
– v_sukt
Jan 3 at 11:48
how about encrypting them and reading them at runtime from memory
– v_sukt
Jan 3 at 11:48
please explain? where would I keep those keys?
– eran meiri
Jan 3 at 13:27
please explain? where would I keep those keys?
– eran meiri
Jan 3 at 13:27
keep the encrypted one in image - which can be decrypted and moved the tmpfs at runtime (one can still copy if one knows the location inside the container) or read from the memory say like bash variable (if one knows the name one can use docker exec at runtime and print the value). So you can ask for decryption key at runtime - when container runs it'll ask for this first. [haven't used user input from ENTRYPOINT script - but should work normally when docker run is with -ti (terminal+interactive) options] - but you'll have to handle this in code for using it for TLS/SSL/smthng similar
– v_sukt
Jan 3 at 14:00
keep the encrypted one in image - which can be decrypted and moved the tmpfs at runtime (one can still copy if one knows the location inside the container) or read from the memory say like bash variable (if one knows the name one can use docker exec at runtime and print the value). So you can ask for decryption key at runtime - when container runs it'll ask for this first. [haven't used user input from ENTRYPOINT script - but should work normally when docker run is with -ti (terminal+interactive) options] - but you'll have to handle this in code for using it for TLS/SSL/smthng similar
– v_sukt
Jan 3 at 14:00
Or why don't you execute the package only if authenticated with some command-line argument?? - say ENTRYPOINT script manages authentication then does decryption on basis of that and then execute the decrypted section?? | don't know how one can manage this but there is something like docker-secrets (docs.docker.com/engine/swarm/secrets)
– v_sukt
Jan 3 at 14:05
Or why don't you execute the package only if authenticated with some command-line argument?? - say ENTRYPOINT script manages authentication then does decryption on basis of that and then execute the decrypted section?? | don't know how one can manage this but there is something like docker-secrets (docs.docker.com/engine/swarm/secrets)
– v_sukt
Jan 3 at 14:05
regarding he first option , how will the encrypted key be decrypted? who will decrypt it? if I use and environment variable to hide the encryption key it will be visible via simple docker inspect command
– eran meiri
Jan 3 at 20:44
regarding he first option , how will the encrypted key be decrypted? who will decrypt it? if I use and environment variable to hide the encryption key it will be visible via simple docker inspect command
– eran meiri
Jan 3 at 20:44
|
show 1 more comment
1 Answer
1
active
oldest
votes
0
No.
Docker doesn't have any way to selectively limit which commands a user can run. Also, if you can docker run anything at all, you can, for instance, put yourself in the host's /etc/sudoers file and start poking around in /var/lib/docker for *.key files: anyone who can run Docker commands has unrestricted root access to the host.
answered Jan 3 at 11:04
David MazeDavid Maze
15.9k31532
is there a way of putting it as a environment variable without showing in docker inspect command?
– eran meiri
Jan 3 at 21:13
A privileged user on the host will be able to see every process's environment. If your concern is around malicious users that could potentially rundocker cp, then an environment variable is not "safe" regardless of whether or notdocker inspectshows it.
– David Maze
Jan 3 at 22:52
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54019535%2fhow-to-disallow-docker-cp-option%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
No.
Docker doesn't have any way to selectively limit which commands a user can run. Also, if you can docker run anything at all, you can, for instance, put yourself in the host's /etc/sudoers file and start poking around in /var/lib/docker for *.key files: anyone who can run Docker commands has unrestricted root access to the host.
answered Jan 3 at 11:04
David MazeDavid Maze
15.9k31532
is there a way of putting it as a environment variable without showing in docker inspect command?
– eran meiri
Jan 3 at 21:13
A privileged user on the host will be able to see every process's environment. If your concern is around malicious users that could potentially rundocker cp, then an environment variable is not "safe" regardless of whether or notdocker inspectshows it.
– David Maze
Jan 3 at 22:52
add a comment |
0
No.
Docker doesn't have any way to selectively limit which commands a user can run. Also, if you can docker run anything at all, you can, for instance, put yourself in the host's /etc/sudoers file and start poking around in /var/lib/docker for *.key files: anyone who can run Docker commands has unrestricted root access to the host.
answered Jan 3 at 11:04
David MazeDavid Maze
15.9k31532
is there a way of putting it as a environment variable without showing in docker inspect command?
– eran meiri
Jan 3 at 21:13
A privileged user on the host will be able to see every process's environment. If your concern is around malicious users that could potentially rundocker cp, then an environment variable is not "safe" regardless of whether or notdocker inspectshows it.
– David Maze
Jan 3 at 22:52
add a comment |
0
0
0
No.
Docker doesn't have any way to selectively limit which commands a user can run. Also, if you can docker run anything at all, you can, for instance, put yourself in the host's /etc/sudoers file and start poking around in /var/lib/docker for *.key files: anyone who can run Docker commands has unrestricted root access to the host.
answered Jan 3 at 11:04
David MazeDavid Maze
15.9k31532
No.
Docker doesn't have any way to selectively limit which commands a user can run. Also, if you can docker run anything at all, you can, for instance, put yourself in the host's /etc/sudoers file and start poking around in /var/lib/docker for *.key files: anyone who can run Docker commands has unrestricted root access to the host.
answered Jan 3 at 11:04
David MazeDavid Maze
15.9k31532
answered Jan 3 at 11:04
David MazeDavid Maze
15.9k31532
answered Jan 3 at 11:04
David MazeDavid Maze
15.9k31532
answered Jan 3 at 11:04
David MazeDavid Maze
15.9k31532
15.9k31532
is there a way of putting it as a environment variable without showing in docker inspect command?
– eran meiri
Jan 3 at 21:13
A privileged user on the host will be able to see every process's environment. If your concern is around malicious users that could potentially rundocker cp, then an environment variable is not "safe" regardless of whether or notdocker inspectshows it.
– David Maze
Jan 3 at 22:52
add a comment |
is there a way of putting it as a environment variable without showing in docker inspect command?
– eran meiri
Jan 3 at 21:13
A privileged user on the host will be able to see every process's environment. If your concern is around malicious users that could potentially rundocker cp, then an environment variable is not "safe" regardless of whether or notdocker inspectshows it.
– David Maze
Jan 3 at 22:52
is there a way of putting it as a environment variable without showing in docker inspect command?
– eran meiri
Jan 3 at 21:13
is there a way of putting it as a environment variable without showing in docker inspect command?
– eran meiri
Jan 3 at 21:13
A privileged user on the host will be able to see every process's environment. If your concern is around malicious users that could potentially run
docker cp, then an environment variable is not "safe" regardless of whether or not docker inspect shows it.– David Maze
Jan 3 at 22:52
A privileged user on the host will be able to see every process's environment. If your concern is around malicious users that could potentially run
docker cp, then an environment variable is not "safe" regardless of whether or not docker inspect shows it.– David Maze
Jan 3 at 22:52
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54019535%2fhow-to-disallow-docker-cp-option%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
how about encrypting them and reading them at runtime from memory
– v_sukt
Jan 3 at 11:48
please explain? where would I keep those keys?
– eran meiri
Jan 3 at 13:27
keep the encrypted one in image - which can be decrypted and moved the tmpfs at runtime (one can still copy if one knows the location inside the container) or read from the memory say like bash variable (if one knows the name one can use docker exec at runtime and print the value). So you can ask for decryption key at runtime - when container runs it'll ask for this first. [haven't used user input from ENTRYPOINT script - but should work normally when docker run is with -ti (terminal+interactive) options] - but you'll have to handle this in code for using it for TLS/SSL/smthng similar
– v_sukt
Jan 3 at 14:00
Or why don't you execute the package only if authenticated with some command-line argument?? - say ENTRYPOINT script manages authentication then does decryption on basis of that and then execute the decrypted section?? | don't know how one can manage this but there is something like docker-secrets (docs.docker.com/engine/swarm/secrets)
– v_sukt
Jan 3 at 14:05
regarding he first option , how will the encrypted key be decrypted? who will decrypt it? if I use and environment variable to hide the encryption key it will be visible via simple docker inspect command
– eran meiri
Jan 3 at 20:44