DCA Docker Security Flashcards

What is the purpose of the USER instruction in a Dockerfile?

Answer: To set the username or UID for subsequent RUN, CMD, and ENTRYPOINT instructions

The USER instruction sets the username or UID (and optionally group) that runs subsequent Dockerfile instructions and the container's default process.

Which command correctly creates a Docker secret named 'db_password' with the value 'mysecret'?

Answer: echo 'mysecret' | docker secret create db_password -

Docker secrets are created by piping the secret value to `docker secret create -`, where the dash reads from stdin.

What type of attack does Docker's default seccomp profile primarily help prevent?

Answer: Container escape via dangerous kernel system calls

Docker's default seccomp profile blocks system calls that could be exploited to escape the container sandbox or compromise the host kernel.

What security benefit does enabling user namespace remapping in Docker provide?

Answer: Maps the container's root user (UID 0) to an unprivileged UID on the host

User namespace remapping maps the container's root UID to a non-privileged host UID, significantly reducing the risk if a process escapes the container.

Which Docker daemon flag enables mutual TLS authentication for secure client-to-daemon communication?

Answer: --tlsverify

The `--tlsverify` flag enables TLS authentication for the Docker daemon, requiring both the server and client to present valid certificates.

What is the recommended best practice for handling sensitive configuration data in Docker containers?

Answer: Use Docker secrets or an external secrets manager

Docker secrets or external secrets managers are recommended because they avoid exposing sensitive data in image layers, environment variables, process listings, or `docker inspect` output.