Vulnerability detection on docker images and a model recommendation for running images safely

Along with container-based virtualization technologies, an approach that uses resources specific to application needs has been adopted instead of the traditional virtualization technologies' approach to virtualization of all hardware. Easily created and portable application containers with the use of container-based virtualization technologies works better than conventional virtualization technologies and provides efficient resource use. Docker is a container-based virtualization technology that allows multiple isolated and independent containers to run on the same operating system. Effective use of the resources provided by the container-based virtualization technology has not only increased the demand for the use of Docker containers, but also played an active role in the management of micro services. Expansion of corporate and individual use of Docker containers; It has made the Docker platform an important target for attackers. Billions of downloads of millions of Docker images in the Docker Hub repository have created the problem of safe execution of Docker images. To run containers safely on the Docker platform will prevent possible reputation, money and service losses due to cyber attacks. A study was conducted to include static, dynamic analysis and malware detection headings to ensure Docker container security, and a method was suggested about how Docker container security could be handled as a whole through available open source tools. With the proposed method, static and dynamic analyzes of Docker containers will be made to verify that the images do not contain malicious software and vulnerable packages, and malicious images will be detected by analyzing the recorded network traffic of the container. In addition, by means of the proposed method, it is aimed to prevent the harmful behavior of Docker containers by detecting the ports opened outside the control of the system administrator. Keywords: Classic virtualization technology, Docker, IPS/IDS, Container-based virtualization technology, Yara rules, Network traffic analysis