3 ms·

Very cool stuff. How compatible is this with docker-machine?

• Gys 11y ago
  Only for Linux: http://subuser.org/installation.html http://subuser.org/installation.html
  • alexlarsson 11y ago
    From that page: Warning: Being a member of the docker group is equivalent to having root access. Not a great way to limit privileges.
    • Filligree 11y ago
      The user using this has to be in that group, the programs being run do not. For a single-user machine, it may be okay. But I don't trust Docker's security very much.
      • raesene4 11y ago
        any particular reasons you don't trust Docker security?
        • cyphar 11y ago
          The daemon has had many security issues. They also only recently grew support for ACLs (which are only available as plugins), so any user that can write to the Docker socket is essentially equivalent to root.
    • txutxu 11y ago
      I'm not a docker user, but I think on binaries I can always use still capabilities, to limit what they can do. I suppose most of them will be needed in this case, and it's still a concern. Just did want to remember to people about linux capabilities after read your comment: man -k cap | grep capabilities
• timthelion 11y ago
  It works with Docker. If you write a Dockerfile for a program, and create a permissions.json file, then your program will work with subuser. Subuser is a "very thin layer" that makes it easier to use Docker for desktop apps.