Security Antipatterns Containers

Quick Reference

When to Use

• Writing or reviewing Dockerfiles
• Configuring docker-compose.yml or podman-compose.yml
• Setting up container runtime flags
• Implementing CI/CD image pipelines
• Hardening private registries (Harbor, etc.)
• Configuring GPU passthrough for ML workloads
• Auditing container security posture

Module Index

Build-Time Security

• references/dockerfile.md - Dockerfile anti-patterns, multi-stage builds, secrets handling, BuildKit cache poisoning

Runtime Security

• references/runtime-security.md - Privileged mode, capability management, namespace isolation, container escapes
• references/compose-security.md - Docker/Podman Compose patterns, secrets management, network isolation

Supply Chain Security

• references/supply-chain.md - Base image selection, typosquatting, slopsquatting, SBOM, provenance attestation

Platform-Specific

• references/podman-security.md - Rootless containers, user namespaces, Quadlet, systemd integration
• references/gpu-passthrough.md - NVIDIA Container Toolkit CVEs, CDI security, GPU memory isolation

Infrastructure Security

• references/registry-security.md - Harbor vulnerabilities, content trust, anonymous access, webhook security
• references/scanning-sbom.md - Trivy, Grype, Docker Scout, SBOM generation, VEX documents

Common Escape Vectors

Container to Host Escapes (2024-2025)

Verification Commands

# Check container is not running as root
docker exec CONTAINER id

# Check capabilities
docker exec CONTAINER capsh --print

# Check seccomp profile
docker inspect --format='{{.HostConfig.SecurityOpt}}' CONTAINER

# Check for socket mounts
docker inspect --format='{{.Mounts}}' CONTAINER | grep docker.sock

# Scan image for vulnerabilities
trivy image IMAGE:TAG

# Generate SBOM
trivy image --format cyclonedx IMAGE:TAG

See Also

• HackTricks Container Security: https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/docker-security/index.html
• Docker Security Best Practices: https://docs.docker.com/engine/security/
• CIS Docker Benchmark: https://www.cisecurity.org/benchmark/docker