Advanced Infrastructure Penetration Testing

DoS and resource abuse

DoS is a serious threat for Docker platforms. Docker faces many DoS threats, such as:

• Pending signals
• Posix message queues
• Maximum user processes
• Maximum files

To defend against these attacks, we need to:

• Assign memory limits using the -m  option:

docker run  -d -m  512m  <Image_Name>

• Limit the CPU share (1,024 by default) using the -c option:

docker run  -d -c  512  <Image_Name></strong>

Another feature in the Linux kernel that you can use to limit the access processes is cgroups (control groups) using the --cpu-set-cpus flag. You can have a clearer understanding by checking the following illustration.