Security vulnerabilities and automated fixes for docker compose issues
2 posts found
The `opensearch` service defined in `Docker/LocalCluster.s3.yaml` was running with a fully writable root filesystem, giving any process inside the container the ability to modify binaries, drop payloads, or persist malicious changes. The fix pins the container to a read-only root filesystem with `read_only: true`, closing off a common post-compromise persistence and tampering vector while preserving normal OpenSearch operation.
A high-severity privilege escalation vulnerability was discovered in a Docker Compose configuration where the `nginx` service lacked the `no-new-privileges` security option and was running with a writable root filesystem. These misconfigurations could allow a compromised container process to gain elevated permissions or download and execute malicious payloads. The fix applies defense-in-depth by adding `no-new-privileges:true`, enforcing a read-only root filesystem, and redirecting writable path