An Empirical Investigation of Docker Sockets for Privilege Escalation and Defensive Strategies

Abstract

Cloud-based infrastructures often leverage virtualization, but its implementation can be expensive. Traditional coding methods can lead to issues when transitioning code from one computing environment to another. In response, the container paradigm emerged to offer cost-effective and agile delivery. Containers differ from full machine virtualization by compactly encapsulating the entire software and its dependencies. Leveraging containers, developers can create more secure and efficient applications. Docker, a prominent containerization platform, facilitates the execution of docker images. The Docker Hub serves as a popular repository for various images. Given the importance of application security, especially in the face of threats like malware, ransomware, and data breaches, ensuring robust security is imperative. The paper investigates vulnerabilities within Docker containers and proposes defensive strategies to mitigate potential breaches. In addition, it investigates attacks involving Docker sockets and suggests preventive measures for non-root users.