11. Docker Security

Activity 11.01: Setting up a seccomp Profile for the Panoramic Trekking App

Solution:

There are a number of ways in which you can create a seccomp profile that will stop users from performing the mkdir, kill, and uname commands. These steps show one way that this can be done:

1. If you don’t already have postgres image locally, execute the following command:

   docker pull postgres

2. Use the wget command on your system to obtain a copy of the default seccomp profile. Name the file you are downloading as activity1.json:

   wget https://raw.githubusercontent.com/docker/docker/v1.12.3/profiles/seccomp/default.json - O activity1.json

3. Remove the following three commands from the profile to allow us to further lock down our image. Open the activity1.json file with your favorite text editor and remove the following lines from the file. You should look to remove lines 1500 to 1504 to remove the uname command, 669 to 673 to remove the mkdir command, and lines...