For users of my web service running on Ubuntu Server 16.04 or 18.04, I’d like to integrate features from such useful programs as ImageMagick. For example, I’d like to crop their profile pictures or create thumbnails.
But because software in general has bugs, and especially ImageMagick has a lot of them [1] [2], it would obviously best to isolate the execution of ImageMagick from the rest of the server, right?
So what’s the best way to isolate ImageMagick from a security perspective, taking into account that the setup should be as simple as possible and that ImageMagick will have to run every few seconds (or even multiple times per second at peak times)? Ideally, ImageMagick would not only be isolated from the host machine, but ImageMagick executions (with the data they operate on) would be isolated from each other as well.
I guess one can use a VM or containers (e.g. Docker) for this? Are containers better-suited because they are faster to set up and tear down again?
Moreover, what’s a good way to get started? I have taken a look at various manuals, but don’t know where exactly to start and which components I need.
What I have so far is the following. Though I don’t know if that’s actually secure, and the costly installation of packages should only be done once, if possible. Moreover, I’m not sure if this actually allows for parallel execution by multiple users.
Dockerfile:
FROM ubuntu:16.04
RUN apt-get update
RUN apt-get install -y imagemagick
VOLUME ["/my-images"]
WORKDIR /my-images
ENTRYPOINT ["convert"]
Initialization:
docker build -t my-imagemagick .
Usage:
docker run --rm --volume=$(pwd):/my-images:rw my-imagemagick -resize 500 /my-images/input.jpg /my-images/output.jpg
capabilities(7)
manual page. A wrapper program written in C can achieve that.www-data
) and calls ImageMagick. I don’t see how I can drop even those non-root privileges from ImageMagick to prevent it from having the same permissions as the web server, while also preventing privilege escalation through vulnerabilities. I think containerization doesn’t sound bad for this.