detoxd/ubuntu repository overview

⁠Ubuntu - Detoxd Hardened Image

⁠Overview

Ubuntu is a popular Linux distribution based on Debian, developed by Canonical Ltd. Known for its ease of use, extensive package repositories, and strong community support, Ubuntu is one of the most widely used Linux distributions for servers, containers, cloud, and development environments.

⁠Common Use Cases

• Application Servers - Full-featured runtime environment
• Development Containers - Familiar developer environment
• CI/CD Pipelines - Build and test environments
• Cloud Deployments - AWS, Azure, GCP official images
• Desktop Containers - GUI application containers
• Legacy Applications - glibc-dependent software

⁠Security Features (Built-in)

Ubuntu includes several security features:

• AppArmor - Mandatory access control
• UFW - Uncomplicated Firewall
• Automatic Security Updates - Unattended upgrades
• Strong Package Signing - GPG-signed repositories
• Snap Confinement - Sandboxed applications

⁠Security Concerns

Full distributions have larger attack surfaces:

• Larger Image Size - More packages, more vulnerabilities
• Shell Access - Full bash environment
• System Services - systemd, cron, logging
• Development Tools - Compilers, debuggers
• Unnecessary Packages - Default installations

⁠What Detoxd Does

⁠Full System Update

apt-get update
apt-get upgrade -y --no-install-recommends
apt-get dist-upgrade -y

⁠Package Removal

Removes unnecessary and potentially dangerous packages:

• wget - Network downloads
• curl - Network transfers
• netcat* - Network utility
• telnet* - Insecure remote access

⁠User Cleanup

Removes unnecessary system accounts:

• games - Gaming account
• gnats - Bug reporting
• irc - IRC services
• list - Mailing lists
• news - Usenet
• proxy - Proxy services
• uucp - UUCP

⁠Security Hardening

• Removes setuid/setgid bits from binaries
• Cleans apt cache
• Removes shell history
• Secures home directories

⁠Recommended Additional Hardening

⁠Dockerfile Best Practices

FROM detoxd/ubuntu:24.04-detox.1

# Install only what's needed
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        ca-certificates \
        && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# Create non-root user
RUN useradd -r -u 1000 -s /sbin/nologin appuser

# Copy application
COPY --chown=appuser:appuser app /app

# Switch to non-root
USER appuser

WORKDIR /app
CMD ["./myapp"]

⁠Minimize Image Size

# Use slim variant when possible
FROM detoxd/ubuntu:24.04-detox.1

# Chain commands to reduce layers
RUN apt-get update && \
    apt-get install -y --no-install-recommends package && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

⁠Security Scanning

# Scan for vulnerabilities
trivy image detoxd/ubuntu:24.04-detox.1

# Check for rootkits (if chkrootkit installed)
chkrootkit

# Audit system configuration
lynis audit system

⁠Docker Run Security Options

docker run \
    --read-only \
    --cap-drop=ALL \
    --security-opt=no-new-privileges:true \
    --tmpfs /tmp:rw,noexec,nosuid,size=64m \
    --user 1000:1000 \
    detoxd/ubuntu:24.04-detox.1

⁠Comparison with Standard Ubuntu

⁠Version Support

⁠References

• Ubuntu Security⁠
• Ubuntu Server Guide - Security⁠
• CIS Ubuntu Benchmark⁠
• Ubuntu CVE Tracker⁠