The popularity of Docker has seen an increasing volume of activities of downloading and uploading Docker images and their manifests over internet. Since the majority of the Docker images in the public registries are vulnerable, it is important to ensure that images are downloaded only from a source where they have already been scanned for vulnerabilities. To help enforce this policy, FortiGate application control has added signatures for Docker traffic.
|Application control signature||Description|
|Docker||This indicates an attempt to access Docker.|
|Docker_Pull.Blob||This indicates an attempt to pull a blob from Docker.|
|Docker_Push.Blob||This indicates an attempt to push a blob onto Docker.|
|Docker_Pull.Manifest||This indicates an attempt to pull a manifest from Docker.|
|Docker_Push.Manifest||This indicates an attempt to push a manifest onto Docker.|
By updating the signature after initial FortiGate deployment, you should see the Docker-related application controls added.
You can configure firewall policies to allow pulls and pushes with known clean private Docker registries using their IPs (or IPs except for malicious and blacklisted ones) as either sources or destinations while having awareness of Docker-related application in traffic.
Apart from application control, FortiGate also scans all the traffic in the Docker environment for vulnerabilities and file-based threats using Intrusion Prevention Service (IPS) and Advanced Malware Protection (AMP).
Latest posts by In Hye Lee (see all)
- Protecting Docker Environments from Security Threats - July 27, 2018
- Deploying FortiManager for GCP - July 5, 2018
- Deploying FortiAnalyzer for GCP - July 5, 2018