Hardening Containers with Static and Dynamic Analysis

Abstract

Containers are a popular technology that helps build portable and scalable applications. They use lightweight virtualization that wraps an application with all its dependencies, binaries and libraries. They are also isolated, and therefore, useful in systems that host multiple applications. The security of these containers is an important, yet widely overlooked, aspect of container deployment and maintenance. Since the use of containers is extensive and only growing, a weak security framework can lead to vulnerable containers and in some cases, vulnerable hosts as well. Though guidelines such as the CIS benchmark exist, they are too broad as they harden the entire container without accounting for the compatibility of the security measures with the functionality of the application. It is often observed that on hardening the container, the functionality is hindered and the container, though now secure, is unable to perform the task it was created for. Thus, selecting which parts of the benchmark to apply and which to skip is a crucial part of developing a hardening policy. This paper deals with hardening containers, specifically those provided by a company that we shall not name. This is done by analyzing the image statically (before it is deployed) and then dynamically (while it is running). The results are then used and analyzed to create a hardening policy for the containers.