3 ms·
Just for the uninitiated: suid binaries are binaries with a special flag set that will make it run with root privileges regardless of who started it. sudo is
by arghwhat 8y ago
Just for the uninitiated:
suid binaries are binaries with a special flag set that will make it run with root privileges regardless of who started it.
sudo is an example of something that would use suid. When a user runs sudo, the binary actually runs with root privileges from the get-go, checks if the user is OK, then executes the command you specified.
However, use of sudo or other suid binaries is entirely pointless in an alpine container. There being no password also does not matter, as you are by default already running everything as root. Who cares if root can become root?
- zaarn 8y agoWell in theory someone could escalate their privileges to the exact same ones they already have! THAT'S TERRIBLE!
- javagram 8y ago> There being no password also does not matter, as you are by default already running everything as root. Who cares if root can become root? Best practice would have you switch to a non root user before running whatever it is inside the container. Although if you haven’t added any suid binaries by accident then there’s no way to go back. E.g. the node alpine image adds a “node:node” user and group for the process to run as instead of root. https://github.com/nodejs/docker-node/blob/master/10/alpine/Dockerfile https://github.com/nodejs/docker-node/blob/master/10/alpine/...
- code_duck 8y agoOK, so what’s the entire point of this article then?