Securing 3rd Party App Integration in Docker-based Cloud Software Ecosystems

TL;DR

This paper proposes a comprehensive security framework for integrating third-party applications into Docker-based cloud ecosystems, emphasizing sandbox testing and lifecycle security to mitigate vulnerabilities.

Contribution

It introduces a novel security approach that leverages Docker's features for safe third-party app integration in cloud environments, including sandbox testing and lifecycle management.

Findings

Enhanced security through sandbox testing of third-party apps

Lifecycle security measures for Docker-based ecosystems

Improved protection against Docker vulnerabilities

Abstract

Open software ecosystems are beneficial for customers; they benefit from 3rd party services and applications, e.g. analysis of data using apps, developed and deployed by other companies or open-source communities. One significant advantage of this approach is that other customers may benefit from these newly developed applications as well. Especially software ecosystems utilizing container technologies are prone to certain risks. Docker, in particular, is more vulnerable to attacks than hypervisor based virtualisation as it directly operates on the host system. Docker is a popular representative of containerisation technology which offers a lightweight architecture in order to facilitate the set-up and creation of such software ecosystems. Popular Infrastructure as a Service cloud service providers, like Amazon Web Services or Microsoft Azure, jump on the containerisation bandwagon and provide interfaces for provisioning and managing containers. Companies can benefit from that change of technology and create software ecosystems more efficiently. In this paper, we present a new concept for significant security improvements for cloud-based software ecosystems using Docker for 3rd party app integration. Based on the security features of Docker we describe a secure integration of applications in the cloud environment securely. Our approach considers the whole software lifecycle and includes sandbox testing of potentially dangerous 3rd party apps before these became available to the customers.