DCA Docker Security Flashcards

What is the purpose of Docker Content Trust (DCT)?

Answer: To sign and verify the authenticity and integrity of Docker images

Docker Content Trust uses digital signatures via The Update Framework (TUF) to verify the integrity and publisher of Docker images.

Which Linux feature does Docker use to filter the system calls a container can make to the kernel?

Answer: Seccomp

Docker uses seccomp (secure computing mode) profiles to restrict which system calls a container process can invoke.

What does running a container with the `--privileged` flag do?

Answer: Grants the container almost all Linux capabilities and access to host devices

The `--privileged` flag grants the container nearly all the same access to the host as native processes running outside containers.

What is the default user that processes run as inside a Docker container if not otherwise specified?

Answer: root

By default, container processes run as root (UID 0) unless a different user is specified via the USER Dockerfile instruction or the --user runtime flag.

Which Linux kernel feature does Docker primarily use to isolate container processes from the host system?

Answer: namespaces

Linux namespaces provide isolation for PIDs, network interfaces, mount points, users, and other system resources between containers and the host.

Which Docker feature is used to securely store and transmit sensitive data like passwords to Swarm services?

Answer: Docker secrets

Docker secrets provide a secure mechanism for storing sensitive data, encrypted at rest and transmitted only to authorized Swarm service containers.