关键词: 云计算, 容器安全, Docker, 隔离性

Abstract:

Cloud computing is another innovative concept that emerged after the Internet and computer in the information age. The future development of emerging technologies such as big data, the Internet of Things and 5G communications cannot be separated from the support of cloud computing.Virtualization is one of the key technologies supporting cloud computing.The existing virtualization methods are mainly divided into virtual machine-based virtualization and container-based virtualization. With the advent of Docker, container technology has become more popularin cloud services.Compared with traditional virtual machines, Docker containers are significantly more lightweight and high-performance. However, Docker use software to achieve isolation, which is weaker than virtual machines. As a result, Docker have to face more serious security issues. Poor isolation has become one of the main security challenges faced by Docker, which seriously affects the further promotion and development of container technology. As a result, the study on the security of container isolation is of great significance. This paper studies the security issues caused by the weak isolation of Docker in cloud environment. We analyze the Docker container isolation mechanism. And the results show that some pseudo file systems in Docker have not been isolated. We can obtain the host-related information through the non-isolated pseudo file system, which causes the host information leakage.In addition, through experiments, this paper further proves that once the host information leakage is maliciously used by an attacker, it can cause security issues such as co-existence of malicious containers and co-resident containers DoS attacks, which pose a serious security threat to co-resident legal container services.

Key words: cloud computing, container security, Docker, isolation