{"id":757,"date":"2019-09-29T02:36:17","date_gmt":"2019-09-29T02:36:17","guid":{"rendered":"https:\/\/www.devsecops.ltd\/?p=757"},"modified":"2024-05-24T15:49:23","modified_gmt":"2024-05-24T15:49:23","slug":"lesson-1-understand-docker-from-a-security-perspective","status":"publish","type":"post","link":"https:\/\/www.devsecops.ltd\/lesson-1-understand-docker-from-a-security-perspective\/","title":{"rendered":"Lesson 1: Understand Docker from a security perspective"},"content":{"rendered":"

If you know the enemy and know yourself, you need not fear the result of a hundred battles \u2015 Sun Tzu<\/p><\/blockquote>\n

A few years ago, I was doing a pentest and after spending 3 days, I couldn’t find even a single security issue.<\/span><\/p>\n

As this has never happened before, you can guess my frustration.<\/p>\n

Turnouts, I wasn\u2019t doing two things.<\/p>\n

One, I wasn’t following Sun Tzu’s wisdom.<\/p>\n

“If you know the enemy and know yourself, you need not fear the result of a hundred battles”<\/p>\n

I had knowledge but no wisdom. Wisdom is learning about the target before you attack it.<\/p>\n

I spent the next two days learning about the app (as a user) and tried pentesting the app again.<\/p>\n

Guess how many security issues did I find? a lot!<\/p>\n

So before you learn how to attack containers, you need to understand a few things about containers.<\/p>\n

    \n
  1. What is a container (Docker)?<\/li>\n
  2. Why do we use it?<\/li>\n
  3. Who uses it, where and when?<\/li>\n
  4. How can Docker make my life easier?<\/li>\n<\/ol>\n

    So let’s dig in.<\/p>\n

    \n
    \n

    Table of Contents<\/p>\nToggle<\/span><\/path><\/svg><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n