Content-Type: multipart/alternative;
 boundary="------------QrziNHphSbJOYfhK3uhZWext"
Message-ID: <e7f014fc-85b7-4eeb-b943-d6107dd58a25@netcologne.de>
Date: Fri, 3 May 2024 07:14:57 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: postgresql in docker to improve security
To: pgsql-admin@lists.postgresql.org
References: <F669A04E-CF43-4A07-B4C9-7A210CEAF19E@adcubum.com>
 <ME3PR01MB7362CB509A8274FBC27509AE8E182@ME3PR01MB7362.ausprd01.prod.outlook.com>
 <CAAPsdhdORCqnqGeMDyWQFE3PcF54kOB6-20U7mQCZ4nheCFUhQ@mail.gmail.com>
Content-Language: en-US
From: vrms <vrms@netcologne.de>
In-Reply-To: 
 <CAAPsdhdORCqnqGeMDyWQFE3PcF54kOB6-20U7mQCZ4nheCFUhQ@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/e7f014fc-85b7-4eeb-b943-d6107dd58a25%40netcologne.de>
Precedence: bulk

This is a multi-part message in MIME format.
--------------QrziNHphSbJOYfhK3uhZWext
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

interesting points @Kashif.

On the other hand I often, that containers are by design ephemeral  and 
tend to crash. This would be a threat to data integrity (allegedly more 
then running in a VM i.e.).

Admittedly the environment I am working in is not very open to, nor 
experienced with container-technology in general, so these claims might 
be based on hearsay and those issues might not be actual problems any 
more these days.

Any thoughts on that?


Also I made a mark in my mind head thad podman, by design, was just a 
little more secure then Docker. I think it was due to the fact 
Containers can run without the need of requiring root privileges for the 
user running a podman container.


On 5/3/24 5:23 AM, Kashif Zeeshan wrote:
> Hi
>
> Yes docker container improves the security and following are the ways 
> it does.
> 1. Isolation : When you run postgres in a container, you are isolating 
> it from host os and other containers so it limits the attack surface.
> 2. Port mapping : By mapping only the necessary container port and 
> allowing access only using that port limits the attack surface.
> 3. You can manage the access privileges of the users that run container
> 4. Docker containers use namespaces for process isolation and security.
>
> Regards
> Kashif Zeeshan
> Bitnine Global
>
> On Fri, May 3, 2024 at 3:44 AM Nguyen, Long (IM&T, St. Lucia) 
> <Long.Nguyen@csiro.au> wrote:
>
>     Good day. This is a general db question.
>
>     I start exploring containerisation and start learning docker. 
>     Would having postgresql in docker improve security in the sense
>     that users could only access to the db through the port mapped to
>     the environment outside of docker, and if they somehow are able to
>     hack and access outside the db, the access is limited within the
>     container not the OS that host the container.
>
>     Thanks.
>


On 5/3/24 5:23 AM, Kashif Zeeshan wrote:
> Hi
>
> Yes docker container improves the security and following are the ways 
> it does.
> 1. Isolation : When you run postgres in a container, you are isolating 
> it from host os and other containers so it limits the attack surface.
> 2. Port mapping : By mapping only the necessary container port and 
> allowing access only using that port limits the attack surface.
> 3. You can manage the access privileges of the users that run container
> 4. Docker containers use namespaces for process isolation and security.
>
> Regards
> Kashif Zeeshan
> Bitnine Global
>
> On Fri, May 3, 2024 at 3:44 AM Nguyen, Long (IM&T, St. Lucia) 
> <Long.Nguyen@csiro.au> wrote:
>
>     Good day. This is a general db question.
>
>     I start exploring containerisation and start learning docker. 
>     Would having postgresql in docker improve security in the sense
>     that users could only access to the db through the port mapped to
>     the environment outside of docker, and if they somehow are able to
>     hack and access outside the db, the access is limited within the
>     container not the OS that host the container.
>
>     Thanks.
>
--------------QrziNHphSbJOYfhK3uhZWext
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-text-html" lang="x-unicode"> <font
        face="Helvetica, Arial, sans-serif">interesting points @Kashif.
        <br>
        <br>
        On the other hand I often, that containers are by design
        ephemeral  and tend to crash. This would be a threat to data
        integrity (allegedly more then running in a VM i.e.).<br>
        <br>
        Admittedly the environment I am working in is not very open to,
        nor experienced with container-technology in general, so these
        claims might be based on hearsay and those issues might not be
        actual problems any more these days.<br>
        <br>
        Any thoughts on that?<br>
        <br>
        <br>
        Also I made a mark in my mind head thad podman, by design, was
        just a little more secure then Docker. I think it was due to the
        fact Containers can run without the need of requiring root
        privileges for the user running a podman container.<br>
        <br>
        <br>
        <br>
      </font><br>
      <div class="moz-cite-prefix">On 5/3/24 5:23 AM, Kashif Zeeshan
        wrote:<br>
      </div>
      <blockquote type="cite"
cite="mid:CAAPsdhdORCqnqGeMDyWQFE3PcF54kOB6-20U7mQCZ4nheCFUhQ@mail.gmail.com">
        <div dir="ltr">Hi
          <div><br>
          </div>
          <div>Yes docker container improves the security and following
            are the ways it does.</div>
          <div>1. Isolation : When you run postgres in a container, you
            are isolating it from host os and other containers so it
            limits the attack surface.</div>
          <div>2. Port mapping : By mapping only the necessary container
            port and allowing access only using that port limits the
            attack surface.</div>
          <div>3. You can manage the access privileges of the users that
            run container</div>
          <div>4. Docker containers use namespaces for process
            isolation and security.</div>
          <div><br>
          </div>
          <div>Regards</div>
          <div>Kashif Zeeshan</div>
          <div>Bitnine Global</div>
        </div>
        <br>
        <div class="gmail_quote">
          <div dir="ltr" class="gmail_attr">On Fri, May 3, 2024 at
            3:44 AM Nguyen, Long (IM&amp;T, St. Lucia) &lt;<a
              href="mailto:Long.Nguyen@csiro.au"
              class="moz-txt-link-freetext">Long.Nguyen@csiro.au</a>&gt;
            wrote:<br>
          </div>
          <blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
            <div class="msg-4187414495819913515">
              <div style="overflow-wrap: break-word;" lang="EN-AU">
                <div class="m_-4187414495819913515WordSection1">
                  <p class="MsoNormal"><span
                      style="font-family:Aptos,sans-serif">Good day.
                      This is a general db question.</span></p>
                  <p class="MsoNormal"><span
                      style="font-family:Aptos,sans-serif"> </span></p>
                  <p class="MsoNormal"><span
                      style="font-family:Aptos,sans-serif">I start
                      exploring containerisation and start learning
                      docker.  Would having postgresql in docker improve
                      security in the sense that users could only access
                      to the db through the port mapped to the
                      environment outside of docker, and if they somehow
                      are able to hack and access outside the db, the
                      access is limited within the container not the OS
                      that host the container.</span></p>
                  <p class="MsoNormal"><span
                      style="font-family:Aptos,sans-serif"> </span></p>
                  <p class="MsoNormal"><span
                      style="font-family:Aptos,sans-serif">Thanks.</span></p>
                </div>
              </div>
            </div>
          </blockquote>
        </div>
      </blockquote>
      <br>
      <br>
    </div>
    <br>
    <div class="moz-cite-prefix">On 5/3/24 5:23 AM, Kashif Zeeshan
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAAPsdhdORCqnqGeMDyWQFE3PcF54kOB6-20U7mQCZ4nheCFUhQ@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="ltr">Hi
        <div><br>
        </div>
        <div>Yes docker container improves the security and following
          are the ways it does.</div>
        <div>1. Isolation : When you run postgres in a container, you
          are isolating it from host os and other containers so it
          limits the attack surface.</div>
        <div>2. Port mapping : By mapping only the necessary container
          port and allowing access only using that port limits the
          attack surface.</div>
        <div>3. You can manage the access privileges of the users that
          run container</div>
        <div>4. Docker containers use namespaces for process
          isolation and security.</div>
        <div><br>
        </div>
        <div>Regards</div>
        <div>Kashif Zeeshan</div>
        <div>Bitnine Global</div>
      </div>
      <br>
      <div class="gmail_quote">
        <div dir="ltr" class="gmail_attr">On Fri, May 3, 2024 at 3:44 AM
          Nguyen, Long (IM&amp;T, St. Lucia) &lt;<a
            href="mailto:Long.Nguyen@csiro.au" moz-do-not-send="true"
            class="moz-txt-link-freetext">Long.Nguyen@csiro.au</a>&gt;
          wrote:<br>
        </div>
        <blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
          <div class="msg-4187414495819913515">
            <div style="overflow-wrap: break-word;" lang="EN-AU">
              <div class="m_-4187414495819913515WordSection1">
                <p class="MsoNormal"><span
                    style="font-family:Aptos,sans-serif">Good day. This
                    is a general db question.</span></p>
                <p class="MsoNormal"><span
                    style="font-family:Aptos,sans-serif"> </span></p>
                <p class="MsoNormal"><span
                    style="font-family:Aptos,sans-serif">I start
                    exploring containerisation and start learning
                    docker.  Would having postgresql in docker improve
                    security in the sense that users could only access
                    to the db through the port mapped to the environment
                    outside of docker, and if they somehow are able to
                    hack and access outside the db, the access is
                    limited within the container not the OS that host
                    the container.</span></p>
                <p class="MsoNormal"><span
                    style="font-family:Aptos,sans-serif"> </span></p>
                <p class="MsoNormal"><span
                    style="font-family:Aptos,sans-serif">Thanks.</span></p>
              </div>
            </div>
          </div>
        </blockquote>
      </div>
    </blockquote>
  </body>
</html>

--------------QrziNHphSbJOYfhK3uhZWext--