AWS CodeBuild - Security Implications of Enabling Docker Layer Cache

Question

When creating a Codebuild project it's possible to configure a cache in the Artifacts section to speed up subsequent builds.

Docker layer cache is one of the options there. AWS documentation says:

LOCAL_DOCKER_LAYER_CACHE mode caches existing Docker layers. This mode is a good choice for projects that build or pull large Docker images. It can prevent the performance issues caused by pulling large Docker images down from the network.

Note

You can use a Docker layer cache in the Linux environment only.

The privileged flag must be set so that your project has the required Docker permissions.

You should consider the security implications before you use a Docker layer cache.

The question is: What are those security implications?

Answer 1

I believe the AWS docs have been improved since the question was raised, but maybe this also would be useful.

A container in the privileged mode does not differ from any other running process with all the capabilities on the host machine. It undermines the whole idea of container isolation. Privileged mode opens a possibility for a container to escape from its namespaces and have read/write access to the root partition, and/or access network devices (any sort of direct interaction with the system).

In case a container has an exploit, the security implications could be

• disk partitions encryption/deletion
• .ssh/authorized_keys modifications