- ‣ Google's cloud business lost over $ 5.5 billion last year
- ‣ Microsoft Azure Functions Vulnerable to Docker Escape Bug
- ‣ Pinecone, a serverless vector database for machine learning, leaves stealth with $10M funding
- ‣ Researchers detect new malware targeting Kubernetes clusters to mine Monero
- ‣ GitLab Changes its Pricing Plan; Drops Starter Tier
- ‣ Microsoft Security Business Surpasses $10 Billion in Revenue
- ‣ Researchers uncover a 10-year old vulnerability in Linux
- ‣ IBM Introduces New Cloud Pricing
- ‣ AWS to offer free eight-week training
- ‣ IBM acquires cloud consultancy firm - Taos Mountain
- ‣ Driftctl: A Tool to detect Infrastructure Drifts
- ‣ New Work From Home Expansion From OpsRamp Network.
- ‣ AWS announces forks of Elasticsearch and Kibana
- ‣ CockroachLabs Secures $160M to Grow Their Distributed SQL Database
- ‣ AWS Unveils The New ML-Powered Amazon DevOps Guru
- ‣ Grafana Adds A Free Tier To Its Cloud Observability Platform
- ‣ Sysdig Report Says 58% Of Container Images Run As Root
Sysdig Report Says 58% Of Container Images Run As Root
Jan. 27, 2021, 12:30 a.m. in DevSecOps
Topline
Sysdig, the cloud-based security startup, released the 2021 Container Security and Usage report that analyzes the trends of the Sysdig enterprise customer base. One of the most disturbing trends highlighted in the report is that most customers did not understand the risk of containers running as root.

Key Facts
The report emphasized the need for developers to set policies that will help detect anomalous behavior and trigger security alerts at run time. Runtime security for Kubernetes is still not a priority for many organizations.
Organizations understand the need to scan for vulnerabilities, but they still do not scan for common configuration mistakes. 58% of all images are running as root, which may potentially compromise privileged containers.
According to the report, Sysdig noticed a rise in suspicious filesystem and container violations. The violations were detected by Falco security policies that are enabled by default in Sysdig Secure.
The report also highlighted Falco, the CNCF Open Source project contributed by Sysdig, which now has over 20 million Docker Hub pulls, accounting for 300% growth. Falco enables the definition of runtime policies that detect security violations and generate alerts.
Details
According to the Sysdig report, 58% of all container images run as root. Container images, unless specifically needed, should be run in the context of a less privileged user than the root to minimize the chances of a breach.
The report also says that organizations have only just begun addressing the need for runtime security for Kubernetes. A container runtime is software that executes containers and manages container images in a machine.
The 2021 Container Security and Usage report also listed the top 7 runtime policy violations:
- Write below etc: Adding or altering files may be an attempt to change the application behavior.
- Launch Privileged Container: These can interact with host system devices causing harm to the host OS.
- Write below root: Modifying data in these directories could be an illegal attempt to install software on the container.
- Suspicious Filesystem changes: It could be an attempt to access sensitive data.
- Launch Sensitive Mount Container: Indicates the container may have access to data volumes containing sensitive information.
- Suspicious Container activity: May indicate compromise within the container system.
- Terminal shell in container: Enables the attacker to manipulate or initiate malicious activity on the system.
Recommended read: 51% of 4 million Docker images have critical vulnerabilities
With increasing concerns about security in container environments, the continuing growth of Falco means more users are taking advantage of community-based rules. As the Falco project grows, Kubernetes security is strengthened by the collective group working together against bad actors.Chris AniszczykCTO of CNCF