AWS CodeBuild - Security Implications of Enabling Docker Layer Cache

Question

When creating a Codebuild project it's possible to configure a cache in the Artifacts section to speed up subsequent builds.

Docker layer cache is one of the options there. AWS documentation says:

LOCAL_DOCKER_LAYER_CACHE mode caches existing Docker layers. This mode is a good choice for projects that build or pull large Docker images. It can prevent the performance issues caused by pulling large Docker images down from the network.

Note

You can use a Docker layer cache in the Linux environment only.

The privileged flag must be set so that your project has the required Docker permissions.

You should consider the security implications before you use a Docker layer cache.

The question is: What are those security implications?

Perlaperle

We'll make it clear in the CodeBuild documentation. Enabling privileged mode gives escalated privilege to the running Docker environment (e.g. needed for accessing docker inside CodeBuild's container), but your builds themselves get VM-level isolation. If you are building say a multi-tenant solution on top of CodeBuild, you should know that the underlying environment is being granted escalated privilege if you enable the privileged mode. Privileged mode is not enabled by default and customers opt-in based on their use case needs. – Loudermilk

Answer 1

I believe the AWS docs have been improved since the question was raised, but maybe this also would be useful.

A container in the privileged mode does not differ from any other running process with all the capabilities on the host machine. It undermines the whole idea of container isolation. Privileged mode opens a possibility for a container to escape from its namespaces and have read/write access to the root partition, and/or access network devices (any sort of direct interaction with the system).

In case a container has an exploit, the security implications could be

• disk partitions encryption/deletion
• .ssh/authorized_keys modifications

Mele