Application Container Security Guide¶
(2017). Application Container Security Guide. National Institute of Standards and Technology.
Cited by¶
3 citations across 3 artifacts.
Each citation links to the sentence it supports in the citing article.
Mechanisms¶
- Container Runtime
- Its central honesty problem is that a shared-kernel runtime is an operational boundary, not a hardened security one: it shares the host kernel, so a kernel-level exploit can escape the container in a way it could not escape a full virtual machine.
This sourceNational Institute of Standards and Technology. NIST SP 800-190. (2017). NIST explains that shared-kernel containers provide less isolation than hypervisors and that host-kernel vulnerabilities can affect every container on the host.
- Its central honesty problem is that a shared-kernel runtime is an operational boundary, not a hardened security one: it shares the host kernel, so a kernel-level exploit can escape the container in a way it could not escape a full virtual machine.
- OCI Container Image
- The discipline that keeps it honest is to deploy by digest, keep the base minimal, and rebuild to patch
This sourceRecommends patching container vulnerabilities by rebuilding images with updated components.
- The discipline that keeps it honest is to deploy by digest, keep the base minimal, and rebuild to patch
- Sandboxed Execution Environment
- And sandboxes are escapable — a sandbox escape through a kernel or hypervisor bug defeats the whole containment.
This sourceExplains that container isolation can be breached through host operating-system vulnerabilities, allowing compromise beyond the intended containment boundary.
- And sandboxes are escapable — a sandbox escape through a kernel or hypervisor bug defeats the whole containment.
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Not recorded. Neither this nor any other of the 3 citations of this work carries a recorded support check.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 1 other way.
Registry ID ref:0dfe8e7b10d1 · see in the full table