DockerShield is a specialized tool for auditing the security of running Docker containers. While regular scanners look for vulnerabilities in the code, DockShield looks for errors in the startup configuration that may allow an attacker to "escape" from the container to the host system (Container Escape).
The project is aimed at system administrators and information security specialists working with modern environments based on Arch Linux, Ubuntu and CentOS.
The script analyzes containers for the following critical threats:
- Privileged Mode: Identifies containers running with full access to host resources. This is a critical vulnerability that allows access to the core of the main OS
- Docker Socket Leak: Detects the mounting of /var/run/docker.sock. A container with socket access can manage the entire Docker daemon of the host
- Root-on-Container: Checks whether the process inside the container is running on behalf of the superuser (violating the principle of least privilege)
- Resource Exhaustion (DoS): Checks if there are no RAM limits, which can cause the entire server to crash during an attack inside the container
- Network Isolation: Detects the use of the --net=host mode, which opens the host's network interfaces directly to the container
Requirements
- Docker is installed and running
- Rights to read the Docker API (it is recommended to run via sudo or membership in the docker group)
git clone https://github.com/RomanLivik/docker-shield
cd docker-shield
chmod +x dockershield.sh
sudo ./dockershield.sh
To see how DockShield reacts to vulnerabilities, you can run a test "insecure" container:
docker run -d --name vulnerable_node --privileged -v /var/run/docker.sock:/var/run/docker.sock alpine sleep 1000
Then run ./dockershield.sh and you will see a detailed report with red warnings about critical risks.
The tool is intended to be used as part of an authorized security audit. The author is not responsible for the misuse of the script.
Improvement ideas are welcome!
- Split the fork of the project.
- Create an app for new users (git checkout -b/AmazingFeature feature)
- Make a commit (git commit -m 'Add some amazing features')
- Make a push (git push origin feature/AmazingFeature)
- Make an extraction request