3 ms·
Docker is an obviously bad solution to this. If you can run a docker file you defacto have root on that computer ^1. Firejail could do exactly the same thing,
by traverseda 8y ago
Docker is an obviously bad solution to this. If you can run a docker file you defacto have root on that computer ^1.
Firejail could do exactly the same thing, but without requiring the user running it download an entire second operating system, or requiring them to have root. Also, the sandboxing mechanisms that docker uses are just generally available and aren't hard to use, so if they went that way they may as well just use the actual syscalls that do what they want instead of importing and entire other operating system to run your commands.
This is where my rant about docker, and the habits it encourages, would go. If I could figure out a way to phrase it politely.
1: https://github.com/moby/moby/issues/9976 https://github.com/moby/moby/issues/9976
- akavel 8y agoWow, firejail seems super interesting, thanks a lot for the idea and mention! I'm not sure if I'll manage to use it, but certainly a good direction for some further research! https://firejail.wordpress.com/ https://firejail.wordpress.com/
- fwip 8y agoDocker containers don't need to be (and often aren't) "entire operating systems." Good point about it requiring root, though.
- michaelmior 8y agoThe problem I was suggesting could be solved Docker wasn't with the privileges of up itself, but the problem of commands you write within up being potentially destructive. I didn't say I thought Docker was a good solution.