DCA · Question #10
Following the principle of least privilege, which of the following methods can be used to securely grnt access to the specific user to communicate to a Docker engine? (Choose two.)
The correct answer is B. Utilize openssl to create TLS client and server certificates, configuring the Docker engine to use. Adhering to the principle of least privilege, secure access to the Docker engine can be granted to specific users either by employing TLS certificates for remote connections or by adding the user to the docker group for local access.
Question
Following the principle of least privilege, which of the following methods can be used to securely grnt access to the specific user to communicate to a Docker engine? (Choose two.)
Options
- AUtilize the '--host 0.0.0.0:2375' option to the Docker daemon to listen on port 2375 over TCP on all
- BUtilize openssl to create TLS client and server certificates, configuring the Docker engine to use
- CUtilize the '--host 127.0.0.1:2375' option to the Docker daemon to listen on port 2375 over TCP on
- DGive the user root access to the server to allow them to run Docker commands as root.
- EAdd the user to the 'docker' group on the server or specify the grouè with the '--group' Docker
How the community answered
(52 responses)- A12% (6)
- B77% (40)
- C6% (3)
- D4% (2)
- E2% (1)
Why each option
Adhering to the principle of least privilege, secure access to the Docker engine can be granted to specific users either by employing TLS certificates for remote connections or by adding the user to the `docker` group for local access.
Listening on `0.0.0.0:2375` without TLS exposes the Docker daemon on all network interfaces without authentication, creating a severe security risk that violates the principle of least privilege.
Utilizing TLS client and server certificates ensures encrypted communication and robust authentication for remote Docker engine access, allowing specific users to securely connect by verifying their certificate identity.
While listening on `127.0.0.1:2375` restricts access to the local host, it doesn't provide specific user authentication or encryption, failing to securely grant access to a *specific* user without additional security layers.
Giving a user full root access to the server directly contradicts the principle of least privilege, as it grants unrestricted control over the entire system, far beyond what is needed for Docker operations.
Concept tested: Docker daemon access control and security best practices
Source: https://docs.docker.com/engine/security/https/
Topics
Community Discussion
No community discussion yet for this question.