Hardening Container Images
Hardening container images is crucial for maintaining security. In this case, a new server was set up using Flatcar Container Linux, with the decision to harden any container from the start. PowerDNS Recursor, the official image of which had unnecessary exposure, was chosen as the first container to harden. The image was built by statically compiling pdns-recursor down to two executables using Musl, and excluding SNMP support and the url option for the zoneToCache config item.
A custom launcher was added, implementing Landlock feature to sandbox filesystem and network access. System calls were also restricted to only those needed by the application, using a seccomp.json file with an allowlist. The image is built daily from the latest two stable trains of PowerDNS, and updated with new dependencies automatically if CVEs are discovered.
An SBOM is generated at build time, helping scanners find vulnerabilities. This approach ensures that the container is secure, with minimal unnecessary features and a reduced attack surface.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
