0

I use docker to deploy a lot of apps since a couple of years. Today I ask myself, should I copy my app to a different location in the docker image? I used to copy the file to the root, e.g. COPY . /AppName, but I wonder whether this is secure.

In order to find an answer to this question, this tutorial was read, but it does not clarify where to copy a app inside a docker image and why.

Improve this question

1 Answer 1

Reset to default
6

I don't see a point.

An external attacker (who has access to the host) can easily find where the files are - he only has to look at the last file system layer and will have them presented right there for him.

An internal attacker (who gains access to the container through a misconfigured part of the app or whatever) will also rather easily find them by looking through the process table at /proc and noting the CWDs.

Attacking the image might be easier with a fixed location, as the attacker only has to add another FS layer, overwriting that directory with his own application. But then, if you did not secure your image store, it does not matter anyways what else you do.

So... I'd say the convenience of a common location is good, and little to no security would be gained; and if, then only security by obscurity, which does not count.

Improve this answer
4
  • To complement a small point: Where you put files in a unix architecture has more to do with convention such that everyone can find them easily for maintenance purposes, in case of a container there's few interest as it shouldn't be mutated/maintained.
    – Tensibai
    Feb 12, 2018 at 8:58
  • @Tensibai, the OP says he has "a lot of" apps - putting the files in the same place all the time is a valid maintenance concern (to not always guess where they are in app x, y or z).
    – AnoE
    Feb 12, 2018 at 10:15
  • I meant using the conventional places has fewer interest :)
    – Tensibai
    Feb 12, 2018 at 10:20
  • Security tools like selinux and apparmor will assume locations that map to the filesystem standard, if you leverage those tools placing the files outside of the conventional locations requires you to maintain those mappings, labels and controls.
    – gdahlm
    Feb 12, 2018 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.