Agile Network Access Control in the Container Age

TL;DR

This paper addresses the lack of fine-grained, application-specific network access control in containerized environments, proposing a tool-supported, formally verified solution to improve security management for DevOps workflows.

Contribution

It introduces a formal, tool-supported approach for fine-grained network access control in Docker containers, bridging the gap between high-level policies and low-level enforcement.

Findings

Identifies shortcomings in current network access control for containers

Proposes a formally verified toolset for better policy enforcement

Provides open-source tools to enhance container security

Abstract

Linux Containers, such as those managed by Docker, are an increasingly popular way to package and deploy complex applications. However, the fundamental security primitive of network access control for a distributed microservice deployment is often ignored or left to the network operations team. High-level application-specific security requirements are not appropriately enforced by low-level network access control lists. Apart from coarse-grained separation of virtual networks, Docker neither supports the application developer to specify nor the network operators to enforce fine-grained network access control between containers. In a fictional story, we follow DevOp engineer Alice through the lifecycle of a web application. From the initial design and software engineering through network operations and automation, we show the task expected of Alice and propose tool-support to help. As a full-stack DevOp, Alice is involved in high-level design decisions as well as low-level network troubleshooting. Focusing on network access control, we demonstrate shortcomings in today's policy management and sketch a tool-supported solution. We survey related academic work and show that many existing tools fail to bridge between the different levels of abstractions a full-stack engineer is operating on. Our toolset is formally verified using Isabell/HOL and is available as Open Source.