3 ms·
Apparently Linux privilege escalation bugs are now "Docker container escapes"? Thanks to Twistlock for a detailed article but call it what it is, a Linux vulner
by zenlikethat 9y ago
Apparently Linux privilege escalation bugs are now "Docker container escapes"? Thanks to Twistlock for a detailed article but call it what it is, a Linux vulnerability not specific to Docker.
- top_post 9y agoThis. It's getting a bit hard to read relevant security news now due to this happening a lot.
- Xylakant 9y agoSince people rely on docker containers as an isolation layer between potentially unfriendly services, a linux bug that allows breaking that isolation barrier is a relevant thing. It’s worth being called “docker container escape”
- zenlikethat 9y agoPeople should not rely on that to any degree more than they would rely on colocated processes on a VM being isolated. The easiest way to be safe is to assume that all containers are already broken out of - what would you do then? Make sure processes are running as non-root, use various protection layers (pick your poison - SELinux, gresecurity, etc.), take away capabilities, and don't run workloads you don't trust.
- toomuchtodo 9y agoPeople most definitely should not but very much are expecting a level of isolation between containers that does not exist.
- Xylakant 9y agoI’m not saying they should, but they are. And given the fact that containers are often marketed as “lightweight VMs”, I’m Not very surprised by that.
- akvadrako 9y agoIn this case the analogy is apt - VM isolation is also not very secure - the exploits like row hammer are usually more heavyweight though.
- Xylakant 9y agosure, any Xen guest escape receives equal amounts of press for exactly that reason: It's an isolation barrier breaking down. However, trivial exploits breaking VM isolation have been relatively rare lately.