4 ms·

The big unanswered question in my mind is "why on earth does being in the docker group give root access?". The relevant section from the Docker manual is > Fi

by tome 9y ago

The big unanswered question in my mind is "why on earth does being in the docker group give root access?". The relevant section from the Docker manual is > First of all, only trusted users should be allowed to control your Docker daemon. This is a direct consequence of some powerful Docker features. Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container. This means that you can start a container where the /host directory is the / directory on your host; and the container can alter your host filesystem without any restriction. https://docs.docker.com/engine/security/security/#control-groups https://docs.docker.com/engine/security/security/#control-gr... This does not seem like a necessary consequence of setting up a daemon for building disk images. What am I missing here? Is this an engineering oversight on the part of Docker or is there some technical reason that forces it to be like this?

deleted 9y ago
[deleted]
e12e 9y ago
Afaik as I've been able to figure out, it should be possible to implement the plan9 filserver in userspace, and combine user-mode file-sharing with convenience and performance (esp. for a local host). Unfortunately, I've never been able to find a combination of utilities that actually work and allow this. Which I guess leaves user-mode nfs - or more exotic things like ipfs.
zenlikethat 9y ago
Basically docker group exists because it's a lot easier to get people to just add themselves to that group than to type 'sudo' over and over again. Sad but true. It's not mandatory to use the docker group though. That's completely optional and you could definitely just 'sudo' whenever you do a 'docker' command. The docker _daemon_ needs to run as root because it needs to be able to do all kinds of privileged system calls to actually set up the containers. But if everyone who interacts with the docker daemon is a sudoer, that's not a problem.
- tome 9y ago
  Thanks for the reply. The docs say "only trusted users should be allowed to control your Docker daemon". Presumably this means that the Docker daemon can be coerced into doing all sorts of nasty stuff. Is that right? If so, doesn't that imply that it's badly written?

by tome 9y ago

deleted 9y ago

[deleted]

e12e 9y ago

Afaik as I've been able to figure out, it should be possible to implement the plan9 filserver in userspace, and combine user-mode file-sharing with convenience and performance (esp. for a local host). Unfortunately, I've never been able to find a combination of utilities that actually work and allow this. Which I guess leaves user-mode nfs - or more exotic things like ipfs.

zenlikethat 9y ago

Basically docker group exists because it's a lot easier to get people to just add themselves to that group than to type 'sudo' over and over again. Sad but true. It's not mandatory to use the docker group though. That's completely optional and you could definitely just 'sudo' whenever you do a 'docker' command. The docker _daemon_ needs to run as root because it needs to be able to do all kinds of privileged system calls to actually set up the containers. But if everyone who interacts with the docker daemon is a sudoer, that's not a problem.

tome 9y ago
Thanks for the reply. The docs say "only trusted users should be allowed to control your Docker daemon". Presumably this means that the Docker daemon can be coerced into doing all sorts of nasty stuff. Is that right? If so, doesn't that imply that it's badly written?