PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A no-BS Docker security checklist for the vulnerability-minded developer

aikido.dev | vulnerability | #container-security | #privilege-escalation | #docker | #hardening | #checklist | #network-isolation | #read-only-filesystem | #no-new-privileges
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Docker's namespace isolation helps, but attackers can still escape containers or root the host. This checklist covers read-only filesystems, no-new-privileges, and isolating container networks.
Published
Collected

Related coverage

blog · wiz.io
Docker and Kubernetes, we have got you covered: Wiz simplifies compliance and security posture management for Docker and Kubernetes environments.
Wiz extends its CIS SecureSuite Vendor Certification to CIS Kubernetes v1.7 and Docker 1.6 benchmarks (Levels 1 and 2), bringing 100+ controls for compliance and secure configuration.
research · calif.io
Privilege escalation in AWS Elastic Kubernetes Service
# Privilege escalation in AWS Elastic Kubernetes Service How a pod with the wrong permissions becomes control of the whole cluster. An Trinh and Duc Nguyen April 2, 2023 cloud Update · August 19,...
vulnerability · blog.quarkslab.com
MyReport Updater: From gRPC to SYSTEM
MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.
vulnerability · blog.quarkslab.com
Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739)
Local privilege escalation in the Cato VPN Client through the split-tunnel upload flow, from named pipe to SYSTEM delete and Windows Installer rollback.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
Back