3 ms·
I was always taught that Docker is not suitable for securely separating stuff, just for compartmentalisation. Something about running as root iirc?
by anc84 11y ago
I was always taught that Docker is not suitable for securely separating stuff, just for compartmentalisation. Something about running as root iirc?
- lojack 11y ago> Something about running as root iirc? The daemon runs as root, so your containers are only as secure as the daemon itself.
- DannoHung 11y agoNn, misread
- cyphar 11y ago> > Something about running as root iirc? > The daemon runs as root, so your containers are only as secure as the daemon itself. This is not correct. The daemon only starts and monitors processes in this case. You can start a process as a different user. You can also use user namespaces to make "root in the container" not root on the host.
- roddux 11y agoYou may be thinking about this issue: http://reventlov.com/advisories/using-the-docker-command-to-root-the-host http://reventlov.com/advisories/using-the-docker-command-to-... -- which incidentally is the first thing that came my mind, too. I'm not familiar with docker, but I'm unsure how subuser could work around this.
- timthelion 11y agoSubuser doesn't work around this issue. As a USER you can become root using docker. However, that doesn't mean that your SUBusers can become root. And that's what you are trying to protect your system from. The "less trusted" code that is running in the subusers.
- raesene4 11y agoYou may be thinking of the lack of user namespacing in Docker. Until v1.10 root in a container was the same user as root outside the container. This did not automatically lead to allow a contained user to breakout, but made it easier. In 1.10 user namespacing reduces this risk as the root user in a container can be remapped to another user account outside the container.