Make sure you're only pulling down signed Docker images with Content Trust enabled.
You've probably heard the stories about malicious Docker images being discovered within various repositories. Some of these images range from those containing actual malware/spyware/ransomeware/etc, to the less malicious images that contain root accounts that cannot be fully trusted. Either way, you should not use these images.
The problem is, how does one know if an image contains malicious code? Without building images yourself or going through the arduous process of getting individual images scanned, what can you do?
SEE: Windows 10 security: A guide for business leaders (TechRepublic Premium)
Simply put, you can configure Docker such that a Docker pull command will only succeed if the image being pulled has been signed by the creator. This, of course, isn't a perfect solution, but it will prevent you (or your developers) from pulling down unsigned images from repositories. These image signatures allow for the client-side or runtime verification of the integrity and creator of specific images and image tags.
How this works is with the Docker Content Trust feature that arrived in Docker 1.8, and it's actually quite easy to implement. I'll demonstrate this on Ubuntu Server 18.04, but the process should work fine on any platform running Docker 1.8 or newer.
How this works
Once you've enabled content trust, if you attempt to pull down an unsigned image, you'll get an error, and the image will not pull (Figure A).
With Content Trust in place, the only images that you can pull are signed (Figure B).
Enabling content trust
The first thing to do is enable content trust. You can do this on a temporary basis by opening a terminal window and issuing the command:
Once you do that, Content Trust is working, and you cannot pull down unsigned images. However, using the above method only works in the current shell. As soon as you log out and log back in, you'll be able to pull down unsigned images without a problem. To make this permanent, open a terminal window, issue the command sudo nano /etc/environment and add the following to the bottom of the file:
Save and close that file. Log out and log back in as much as you want, and Content Trust will still be enabled. Your Docker pull commands will only succeed if you're pulling down signed images.
This is not a foolproof solution. Why? Because Docker includes an option that allows you to circumvent the Content Trust feature. Say, for example, you want to pull an unsigned image from Docker Hub (without disabling the environment variable set earlier). You can do this with the command:
docker pull --disable-content-trust nginx/unit
As you can see (Figure C), if you attempt to pull that image without the —disable-content-trust option, the pull will fail. With the option, it succeeds.
A wise addition
Although there may be instances where you want to get around the Content Trust feature, it's always good to enable it, so you're only pulling down signed images. It's not a perfect security solution for Docker, but it's a small step forward for you container deployment.
- How to set up a Ruby on Rails development environment with Docker (TechRepublic)
- How to install Kitematic on Pop!_OS (TechRepublic)
- How to deploy ODOO as a Docker container (TechRepublic)
- Docker embraces Windows Subsystem for Linux 2 (ZDNet)
- How to become a cybersecurity pro: A cheat sheet (TechRepublic)
- 10 dangerous app vulnerabilities to watch out for (TechRepublic download)
- Online security 101: Tips for protecting your privacy from hackers and spies (ZDNet)
- The best password managers of 2019 (CNET)
- Cybersecurity and cyberwar: More must-read coverage (TechRepublic on Flipboard)