Security Practices

Input Validation

Docker CLI performs input validation to mitigate vulnerabilities stemming from malicious input. This is crucial to prevent injection attacks like command injection and cross-site scripting (XSS). Validation includes:

• Regular expressions: Specific regular expressions are used to ensure inputs conform to defined patterns, limiting potential for unexpected behaviors.
• Type checks: Input types are verified to ensure they match expected formats. This helps catch invalid data that could lead to security issues.

Example:

The docker build command performs extensive input validation on the Dockerfile syntax:

// docker/cli/cli/command/build.go
          func (opts *BuildOptions) Validate(dockerfile string) error {
              // ...
              // Validate Dockerfile syntax, including the "FROM" instruction.
              // ...
          }
          

Source: cli/command/build.go

Authentication and Authorization

Docker CLI leverages various mechanisms to ensure secure access to the Docker daemon.

• Docker Hub: Uses a combination of username/password and token-based authentication. The docker login command stores credentials securely.
• Registry Authentication: Supports multiple authentication mechanisms, including basic authentication, token-based authentication, and certificate-based authentication.
• Docker Engine: Enforces authorization policies through user and group management.

Example:

The docker login command handles authentication to Docker Hub:

// docker/cli/cli/command/login.go
          func (opts *LoginOptions) Run(client *docker.Client) error {
              // ...
              // Perform authentication to Docker Hub.
              // ...
          }
          

Source: cli/command/login.go

Secure Communication

Docker CLI utilizes secure communication protocols to protect data during interactions with the Docker daemon.

• TLS/SSL: Encrypts communication between Docker CLI and the daemon, ensuring confidentiality and integrity.
• Mutual TLS: Uses certificates for both client and server authentication, enhancing security by verifying the identities of both parties.

Example:

The dockerd daemon uses TLS for secure communication:

// docker/docker/daemon/daemon.go
          func (daemon *Daemon) serve(ctx context.Context) error {
              // ...
              // Configure TLS options for secure communication.
              // ...
          }
          

Source: https://github.com/docker/docker/blob/main/daemon/daemon.go

Trust (Rootless Docker)

The trust package provides a mechanism for trusted execution environments within Docker. It allows users to run Docker in a secure, isolated environment without requiring root privileges.

Example:

The trust package uses secure enclaves to execute untrusted code safely:

// docker/cli/cli/command/trust.go
          func (opts *TrustOptions) Run(client *docker.Client) error {
              // ...
              // Executes untrusted code within a secure enclave.
              // ...
          }
          

Source: cli/command/trust.go

Secure Communication (ConnHelper)

The connhelper package helps establish secure connections to the Docker daemon.

Example:

The connhelper package manages connection details securely:

// docker/cli/cli/connhelper/connhelper.go
          func (h *ConnHelper) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
              // ...
              // Handles secure connection establishment with the Docker daemon.
              // ...
          }
          

Source: cli/connhelper/connhelper.go

OAuth2

Docker CLI interacts with OAuth2 providers for authentication and authorization:

Example:

The internal/oauth package handles OAuth2 flows:

// docker/cli/cli/internal/oauth/oauth.go
          func (o *OAuth) Login(ctx context.Context, provider string, options ...*oAuthLoginOption) error {
              // ...
              // Performs OAuth2 login flow.
              // ...
          }
          

Source: cli/internal/oauth/oauth.go