DevOps Stack Exchange is a question and answer site for software engineers working on automated testing, continuous delivery, service integration and monitoring, and building SDLC infrastructure. It only takes a minute to sign up.
Sign up to join this community
I use docker to deploy a lot of apps since a couple of years. Today I ask myself, should I copy my app to a different location in the docker image? I used to copy the file to the root, e.g. COPY . /AppName, but I wonder whether this is secure.
In order to find an answer to this question, this tutorial was read, but it does not clarify where to copy a app inside a docker image and why.
I don't see a point.
An external attacker (who has access to the host) can easily find where the files are - he only has to look at the last file system layer and will have them presented right there for him.
An internal attacker (who gains access to the container through a misconfigured part of the app or whatever) will also rather easily find them by looking through the process table at /proc and noting the CWDs.
Attacking the image might be easier with a fixed location, as the attacker only has to add another FS layer, overwriting that directory with his own application. But then, if you did not secure your image store, it does not matter anyways what else you do.
So... I'd say the convenience of a common location is good, and little to no security would be gained; and if, then only security by obscurity, which does not count.
