CRITICAL: Deployed containers have no security constraints (capabilities, seccomp, resource limits) #110

New Issue

clawbot · 2026-02-20T13:50:16+01:00

clawbot commented

2026-02-20 13:50:16 +01:00

Summary

Containers created by upaas have zero security hardening. User-provided Dockerfiles run with full default Docker capabilities, no seccomp profile, no AppArmor, no resource limits, and RestartPolicyUnlessStopped.

Location

internal/docker/client.go — CreateContainer() method (line ~185)

Impact

This is a PaaS platform — users deploy arbitrary code. Without constraints:

Container escape: Default capabilities include CAP_SYS_ADMIN potential via user namespaces, CAP_NET_RAW for network attacks
Resource exhaustion / DoS: No CPU or memory limits means one app can starve all others and the host
Fork bombs / crypto mining: No process count or resource limits
Network attacks: CAP_NET_RAW allows ARP spoofing, packet sniffing on the Docker network

Current Code

resp, err := c.docker.ContainerCreate(ctx,
    &container.Config{
        Image:        opts.Image,
        Env:          envSlice,
        Labels:       opts.Labels,
        ExposedPorts: exposedPorts,
    },
    &container.HostConfig{
        Mounts:       mounts,
        PortBindings: portBindings,
        NetworkMode:  container.NetworkMode(opts.Network),
        RestartPolicy: container.RestartPolicy{
            Name: container.RestartPolicyUnlessStopped,
        },
    },
    ...
)

Suggested Fix

Add to HostConfig:

HostConfig{
    // ... existing fields ...
    SecurityOpt: []string{"no-new-privileges"},
    CapDrop:     []string{"ALL"},
    Resources: container.Resources{
        Memory:    512 * 1024 * 1024, // 512MB default, make configurable
        NanoCPUs:  1000000000,        // 1 CPU default, make configurable
        PidsLimit: int64Ptr(256),
    },
    ReadonlyRootfs: false, // apps may need writable fs, but consider per-app config
}

Make limits configurable per-app (add columns to apps table for memory_limit, cpu_limit).

Severity

CRITICAL — Without this, any deployed app can DoS the host or attempt container escape.

## Summary Containers created by upaas have **zero security hardening**. User-provided Dockerfiles run with full default Docker capabilities, no seccomp profile, no AppArmor, no resource limits, and `RestartPolicyUnlessStopped`. ## Location `internal/docker/client.go` — `CreateContainer()` method (line ~185) ## Impact This is a **PaaS platform** — users deploy arbitrary code. Without constraints: 1. **Container escape**: Default capabilities include `CAP_SYS_ADMIN` potential via user namespaces, `CAP_NET_RAW` for network attacks 2. **Resource exhaustion / DoS**: No CPU or memory limits means one app can starve all others and the host 3. **Fork bombs / crypto mining**: No process count or resource limits 4. **Network attacks**: `CAP_NET_RAW` allows ARP spoofing, packet sniffing on the Docker network ## Current Code ```go resp, err := c.docker.ContainerCreate(ctx, &container.Config{ Image: opts.Image, Env: envSlice, Labels: opts.Labels, ExposedPorts: exposedPorts, }, &container.HostConfig{ Mounts: mounts, PortBindings: portBindings, NetworkMode: container.NetworkMode(opts.Network), RestartPolicy: container.RestartPolicy{ Name: container.RestartPolicyUnlessStopped, }, }, ... ) ``` ## Suggested Fix Add to `HostConfig`: ```go HostConfig{ // ... existing fields ... SecurityOpt: []string{"no-new-privileges"}, CapDrop: []string{"ALL"}, Resources: container.Resources{ Memory: 512 * 1024 * 1024, // 512MB default, make configurable NanoCPUs: 1000000000, // 1 CPU default, make configurable PidsLimit: int64Ptr(256), }, ReadonlyRootfs: false, // apps may need writable fs, but consider per-app config } ``` Make limits configurable per-app (add columns to apps table for memory_limit, cpu_limit). ## Severity **CRITICAL** — Without this, any deployed app can DoS the host or attempt container escape.

sneak commented

2026-02-20 14:29:15 +01:00

WONTFIX, working as intended

sneak closed this issue

2026-02-20 14:29:15 +01:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/upaas#110