Using Burp with Containers In Docker

Making Docker Containers Trust Burp Suite’s CA for Testing

When testing applications running inside Docker containers, intercepting traffic with Burp Suite can be challenging because containers don’t automatically trust Burp’s CA certificate. Without trust, HTTPS requests from inside the container will fail with certificate errors.

In this post, I’ll show you how to:

1. Add Burp Suite’s CA to your host system
2. Pass the trusted CA to Docker containers
3. Ensure seamless HTTPS traffic interception for testing

Let’s get started!

Run X11 applications on docker or podman

Found x11docker project in github. This is a very nice project if you are trying to run GUI applications in dockers. It takes the hassle out and helps you run the GUI applications very easily in docker.

Whats more, if you are on Fedora, you are in luck. You can install this tool with

1

sudo dnf install x11docker

and if you are not on Fedora, then head over to their github. Some other distributions also have it packaged but otherwise also it is very simple to install.

List all the tags for a image on docker hub

Something that you may want to know sometimes and docker cli does not show by default is all the tags for the image on docker hub. Here is example to list all tags fro the centos image

curl https://registry.hub.docker.com/v2/repositories/library/centos/tags |jq '."results"[]["name"]'

The example is for a v2 registry. The output for v1 is different than v2 registry. For a v1 registry, you can use command like below

curl https://registry.hub.docker.com/v1/repositories/centos/tags |jq '.[]["name"]'

Get disk usage for all the containers with python script

With my increasing love for python, here is my attempt to get the disk usage of all the containers on some host. Well, since the requirements vary for everyone, so this script is far from complete.

import docker
import json

# We will connect to 192.168.122.1 for docker daemon. If that is not the case,
# then change the below.

client = docker.DockerClient(base_url="tcp://192.168.122.1:4243")

# Get list of all containers.
cls=client.containers.list()
stats={}

# And now we will iterate over that list to get stats for all the containers.
for val in cls:
    print (val.name)
    stats[val.name] = val.stats(stream=False)
    # Get the disk usage for root and /tmp from containers with docker.exec
    stats[val.name]['df-root'] = ( str(val.exec_run(r'df -kh --output="size,used,avail,pcent" /', stream=False).splitlines()[1]).replace("'","").split()[1:] )
    stats[val.name]['df-tmp'] = ( str((val.exec_run(r'df -kh --output="size,used,avail,pcent" /tmp ', stream=False).splitlines()[1:]+[''])[0]).replace("'","").split()[1:] )

# Now if you want, we have dict of all the data and we can process the
# way we like it, for example create a html table for disk usage only.
print ('<table>')
for st in stats:
    print ('<tr>')
    print ("<td>Root-%s</td>"%(st))
    for i in stats[st]['df-root']:
        print ('<td>%s</td>'%(i) )
    print ('</tr>')
    print ('<tr>')
    print ("<td>tmp-%s</td>"%(st))
    for i in stats[st]['df-tmp']:
        print ('<td>%s</td>'%(i) )
    print ('</tr>')

print ('</table>')

ansible with docker dynamic inventory

So, I have a few dockers. Every now and then I want to run some command on all of them. Doing ‘docker exec’ is tiresome. I found this neat solution with ansible that I thought I should share with you.

To get started, you need to have the “docker.py” script. This script will be used as python script inventory for ansible. So, use the following command and get the script:

docker search description truncated

When you search with “docker search”, you would notice that the description of the image is truncated. Sometimes you want to see full description, to do so, you can use –no-trunc option. So, for example you want to search for fedora images, you can use the following command:

docker search --no-trunc  fedora

apache in docker to serve local website

I have some backup’s of website on my laptop, which I occasionally want to view. Now, I could have setup apache to serve them directly with VirtualHost or alias but wanted a better solution. So, docker comes to rescue.

First, I installed fedora-dockerfiles and then made some modifications, here they are :

sudo yum install fedora-dockerfiles

After this is done, go to /usr/share/fedora-dockerfiles/apache and make some modification to Dockerfile.  After the modifications, the file looks like this