Exposing the host's Docker daemon to a container has severe security impacts. Unfortunately, this insecure practice is common in CI/CD tools. A malicious container or a vulnerability in the CI/CD tool extends the compromise to the host resources. Let's see, in practice, how bad it can get when a CI/CD tool in a container has access to the host's Docker daemon.
We will explore how to implement Docker in Docker (dind) for CI/CD services, detailing their configurations and the associated security concerns.
Let’s head to the lab to discover, debug, and fix this vulnerability within an actual application.
Containers, protected by kernel features like cgroup and tools like AppArmor, do not offer the same protection as virtual machines. A compromised process in a container can be devastating, and since Docker engine and images often lack secure default settings, it is essential to take time to harden them.
