Shoulder.dev Logo Shoulder.dev

Securing the Docker Genai-Stack

Scenario: A developer wants to secure the Genai-Stack against external threats and ensure the confidentiality, integrity, and availability of the application. In this example, we will follow best practices such as network segmentation, strong passwords, and SSL certificates.

  1. Network Segmentation:

Network segmentation is the practice of dividing a network into smaller subnetworks to improve security. In the context of Docker, we can achieve network segmentation by using Docker networks.

a. Create a new Docker network:

Create a new network named genai-stack-network using the following command:

docker network create genai-stack-network

b. Connect containers to the new network:

Connect all the containers in the Genai-Stack to the new network using the --network flag when starting the containers. For example, for the api container:

docker run --network genai-stack-network -d ...
  1. Strong Passwords:

Use strong passwords for all user accounts and services in the Genai-Stack.

a. Set a strong password for the Docker daemon:

Edit the daemon.json file and set a strong password:

{
  "authenticate": true,
  "authorization-plugins": [],
  "tlsverify": true,
  "tlscacert": "/path/to/ca.crt",
  "tlscert": "/path/to/server.crt",
  "tlskey": "/path/to/server.key",
  "experimental": {
    "allow-nondocker": ["127.0.0.1/32"],
    "log-driver": "json-file",
    "log-opts": {
      "max-size": "10m"
    }
  },
  "registry": {
    "insecure": false,
    "index": "unix:///var/run/docker.sock",
    "username": "your_username",
    "password": "your_strong_password"
  }
}

b. Set strong passwords for all user accounts and services in the application.

  1. SSL Certificates:

Use SSL certificates to secure communication between containers and external services.

a. Generate SSL certificates:

Use a certificate authority (CA) to generate SSL certificates for the Genai-Stack. For example, using Let's Encrypt:

sudo snap install certbot --classic
sudo certbot certonly --webroot --webroot-path /var/www/html --email [email protected] --agree-tos --no-eff-email --name your_domain.com

b. Configure containers to use SSL certificates:

Configure the containers in the Genai-Stack to use the SSL certificates. For example, for the api container, edit the nginx.conf file:

server {
  listen 80;
  server_name your_domain.com;
  location / {
    proxy_pass http://api:5000;
    proxy_ssl_certificate /path/to/server.crt;
    proxy_ssl_certificate_key /path/to/server.key;
  }
}

Tests:

  1. Verify that all containers are connected to the new network genai-stack-network.
  2. Verify that all user accounts and services in the Genai-Stack have strong passwords.
  3. Verify that all communication between containers and external services is encrypted using SSL certificates.

References: