2 ms·

> Thats not possible in Docker Believe this at your own peril.

• mschuster91 9y ago
  At least right now, I do not know of a way to break out of a Docker container and the last bug I know of was fixed in 2014 (https://blog.docker.com/2014/06/docker-container-breakout-proof-of-concept-exploit/ https://blog.docker.com/2014/06/docker-container-breakout-pr...). The only ways I know of that can be used to jailbreak are, as documented on https://security.stackexchange.com/a/153016 https://security.stackexchange.com/a/153016: kernel vulns (which are not inherent to Docker, and can hit you on any kind of Linux environment as soon as you achieve RCE in a hosted application), running a container with --privileged, and being careless with bindmounts - either by bind-mounting /dev, /proc and friends which you shouldn't do in any case unless you're aware of the pitfalls or by bind-mounting the Docker socket file. The latter is something that I see far too often (especially with docker-in-docker setups for Jenkins slaves), but if you're avoiding this, you're safe from that vector.
  • xorcist 9y ago
    Docker is comparable to a chroot in this regard. You can not break out of a chroot either, unless you are being careless with super user privileges or bind mounts. Which (unsuprisingly) people are, and that's why it's generally not recommended to use chroot alone for security. Not because chroot somehow is insecure or doesn't work as intended. Docker for the longest time didn't even try to constrict the root user. Later versions does, but the results will vary depending on your configuration. That's why the Docker documentation states it should not be depended on for security. It is wise to heed that recommendation.