A container breakout occurs when compromised application code gains enough access to run arbitrary commands inside its container, changing application behavior or expanding the attack. A large base image can make this easier by including compilers and other build tools that an attacker can reuse. section 17.2
Reduce the available attack surface by:
- Choosing a base image with everything required to run the application, but without unnecessary application-building tools such as a Java SDK. section 17.2
- Using golden images maintained by a team to standardize appropriate organizational base images. section 17.2
- Remembering that interpreted runtimes such as Node.js and Python may be required because the runtime also serves as the build tool. section 17.2
Simulate a breakout in a Java API container
Build and run the truth-app image, call its API, then enter the container with docker container exec. Compile and run the included FileUpdateTest.java using javac and java, exit, and call the API again. The response changes from true to false, demonstrating how bundled build tooling can enable arbitrary code execution inside the application container.
