3 ms·
I think we absolutely should discuss this - the number of images I see on Docker Hub that run complex network services as the root user really concerns me. The
by jcrawfordor 10y ago
I think we absolutely should discuss this - the number of images I see on Docker Hub that run complex network services as the root user really concerns me. The security measures implemented by Docker reduce the risk but absolutely do not eliminate it, you're taking a big risk there.
This issue, along with its related issues with permissions on persistent storage, is one of the major reasons I'm hoping to move away from Docker as soon as possible.
- tannhaeuser 10y agoWhat Docker security measures do you mean? Actually, I was wondering recently what isolation Docker provides that a basic chroot-jail doesn't. Re root permisions I guess if you're running a typical network daemon (Apache, say), then requiring Docker to run as root is no worse than running the service on the host; root would be a requisite anyway for the daemon to open privileged ports/gain logging permissions etc. before dropping to "nobody" or what have you.
- kccqzy 10y agoDocker drops capabilities of root by default. It doesn't drop everything but better than not dropping at all. If you are not using docker, you can manually add the specific privilege to open low-numbered ports without running the program in question as root.