A Systematic Approach to User File Security: From Primary Validation to Isolation in Docker

Abstract

The article presents a description of a system approach to ensuring the security of user files in containerized environments. A system-integrated approach to protecting user files in containerized environments is studied. The paper proposes and substantiates a multi-level algorithm for ensuring the security of user files that integrates validation, threat modeling, and isolation procedures into a single pipeline. The algorithm described in the paper includes the stages of primary static and dynamic analysis of loaded information, preventive threat modeling of the Docker container life cycle using attack trees and the DREAD model, and the use of a set of isolation measures. Clair, Trivy, and Docker Scout are used for static scanning of images, which allows identifying vulnerabilities at the container layer level even before it is launched. In parallel, dynamic monitoring is organized using Falco and Sysdig Secure, which ensures continuous detection of anomalies and unsuspected exploits. Container isolation mechanisms include the use of user namespaces, seccomp profiles, and privilege and resource restrictions, which significantly reduces the possibility of privilege escalation. The presented results have practical value for researchers and information security architects working on formalizing heterogeneous trust models and developing multi-level mechanisms for validating user files, as well as for DevSecOps engineers and Docker platform administrators seeking to integrate dynamic isolation methods and advanced anomaly detection strategies into corporate CI/CD pipelines.