Painless Docker - 2nd Edition

Application-Level Threats

A container is only as secure as the code it executes. Even if the host OS is hardened and the Docker daemon is perfectly configured, the application layer remains a primary target for attackers. In a containerized environment, an application-level breach is often the "entry point" used by attackers to perform a container breakout or begin lateral movement across your internal network.

The OWASP Top 10 and Beyond

Most application-level threats align with the OWASP Top 10, a standard awareness document for developers and web application security. Some of the most critical threats include:

• Injection Attacks (SQLi, NoSQL, Command Injection): An attacker sends malicious data to an interpreter (like a database or shell) to execute unauthorized commands or access data without permission.
• Broken Access Control: Failures that allow users to act outside of their intended permissions, such as accessing other users' accounts or viewing sensitive files.
• Cryptographic Failures (Exposure of Sensitive Data): Failures to protect data in transit and at rest, often through the use of weak encryption or cleartext transmission.
• Vulnerable and Outdated Components: