1

I'm working on a system where a dockerized application must run on client side machines (Ubuntu PC), with some sensitive data that must persist between runs that we want to limit access to. In prototyping I just stored the data in the host file system and used a bind mount to map that folder into the application container.

I want to avoid situtations where someone with access to the machine can just copy out some user data, or even look at it.

What would be a good solution in my case?

What I have read from google this sounds to be a bit of a different use case as to where user data/docker volumes are securely hidden away between the (fire)walls of server rooms and cloud instances and I haven't therefore been able to find a good solution on how to limit access to said user data so that no one (no proccess, nothing) except the running container has access to that data, even with physical access to the machine.

I am also very new to DevOps and deploying systems so I would appreciate any insight on how to solve that matter!

Improve this question
1
  • If you are worried about the data being compromised on the host, then it seems to me the only way to really protect the data is to encrypt it at rest. Whether you do this in a database or in flat files is irrelevant, the data needs to be encrypted. You might have limited room to move on the machine itself if it belongs to a client, but you should definitely try to lock it down as much as possible.
    – Bruce Becker
    Aug 31, 2019 at 5:41

2 Answers 2

Reset to default
1

I want to avoid situtations where someone with access to the machine can just copy out some user data, or even look at it.

You cannot stop someone with local access to the machine from reading data on the machine. Full stop.

Improve this answer
0

You could save the data in a database. That database can be also a container (deploy them both with docker-compose maybe). The database is password protected and it can persist its encrypted data on the disk between runs.

Also you can use Hashicorp Vault (see https://docs.docker.com/samples/library/vault/).

Improve this answer
1
  • 1
    Thanks for the answer! Databases unfortunately will not work, since the main concern of the data are a few files of couple hundred megabytes that can't be put to a database. Will vaults help us with that? Correct me if I am wrong but is a vault basically, in its essence, a password protected volume/folder?
    – Martin1
    Apr 3, 2019 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.