6 ms·

From that page: Warning: Being a member of the docker group is equivalent to having root access. Not a great way to limit privileges.

• Filligree 11y ago
  The user using this has to be in that group, the programs being run do not. For a single-user machine, it may be okay. But I don't trust Docker's security very much.
  • raesene4 11y ago
    any particular reasons you don't trust Docker security?
    • cyphar 11y ago
      The daemon has had many security issues. They also only recently grew support for ACLs (which are only available as plugins), so any user that can write to the Docker socket is essentially equivalent to root.
• txutxu 11y ago
  I'm not a docker user, but I think on binaries I can always use still capabilities, to limit what they can do. I suppose most of them will be needed in this case, and it's still a concern. Just did want to remember to people about linux capabilities after read your comment: man -k cap | grep capabilities