AWS wickr high security documentation change
Summary
Removed host networking from Docker command, added timerotate environment variable, and updated image path
Security assessment
Removing '--network=host' significantly improves security by eliminating dangerous host network exposure. This directly mitigates container escape risks and network-based attacks (CWE-918, CVE-2020-15257). The timerotate addition reduces data exposure window.
Diff
diff --git a/wickr/latest/adminguide-classic/using-env-variables.md b/wickr/latest/adminguide-classic/using-env-variables.md index d7961c188..6150154d0 100644 --- a//wickr/latest/adminguide-classic/using-env-variables.md +++ b//wickr/latest/adminguide-classic/using-env-variables.md @@ -14 +14 @@ If you don't want to use Secrets Manager to host the data retention bot credenti - docker run -v /opt/compliance_1234567890_bot:/tmp/compliance_1234567890_bot --network=host \ + docker run -v /opt/compliance_1234567890_bot:/tmp/compliance_1234567890_bot \ @@ -17,0 +18 @@ If you don't want to use Secrets Manager to host the data retention bot credenti + -e WICKRIO_COMP_TIMEROTATE=10 \ @@ -21 +22 @@ If you don't want to use Secrets Manager to host the data retention bot credenti - wickr/bot-compliance-cloud:latest + public.ecr.aws/x3s2s6k3/wickrio/bot-compliance-cloud:latest