3 ms·
I'd find it a lot easier to believe this isn't a redhat FUD-job if the article listed the entire list of privileges and contrasted those that docker gives by de
by lowbloodsugar 10y ago
I'd find it a lot easier to believe this isn't a redhat FUD-job if the article listed the entire list of privileges and contrasted those that docker gives by default and those that require --privileged [1]. Also required would be meaningful discussion about how other defaults, such as networking, affect these capabilities.
>This one’s easy. If you have this capability, you can bind to privileged ports (e.g., those below 1024).
Sure, it can bind to port 80 on a virtual network device that is unique to that docker container, unless you give the container host network privileges.
[1] https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities https://docs.docker.com/engine/reference/run/#/runtime-privi...
- kccqzy 10y agoThe article told you how to find the entire list of privileges. Just type `man 7 capabilities` or go here: http://man7.org/linux/man-pages/man7/capabilities.7.html http://man7.org/linux/man-pages/man7/capabilities.7.html The `--privileged` flag is equivalent to giving your container all capabilities: https://github.com/docker/docker/blob/97660c6ec55f45416cb2b2d4c116267864b62b65/daemon/exec_linux.go#L23 https://github.com/docker/docker/blob/97660c6ec55f45416cb2b2... I don't get what you mean by saying how networking affects capabilities. Because it doesn't?
- lowbloodsugar 10y agoThe post chooses to emphasize the scary (ZOMG it allows port 22!) without the necessary information that the default networking mode is bridged, such that the container wont be opening port 22 on the host. So the article implies that this capability allows a security risk, but the default networking mitigates that risk.