3 ms·

Well, it happened and on a pretty popular site too. So if they got it wrong how many other people do. This is a core reason folk should check out gVisor. Not su

• lima 7y ago
  gVisor has unsafe modes of operation, too. What I'm saying is that this is not a good example of "Container breakout", as it was just a misconfiguration, not an exploit. "people are extremely creative and will find ways around everything" is not an excuse - it's a matter of risk management and threat modelling. Escaping from a VM or gVisor is much, much harder than escaping from Linux namespaces ("containers") due to the MUCH smaller amount of attack surface/amount of exposed code. Using Linux containers in an untrusted multi-tenant environment is very dangerous, especially if you're a high profile cloud provider, which is why all of these projects exist.
• raesene9 7y ago
  So, play with Docker are trying to do something very niche and not something that almost anyone else would try in production, which is running Docker inside Docker, which they do in order to produce the very cool service they do. Their breach isn't really a good indicator as I can't think of any/many reasons that most companies would try and do that...
  • windexh8er 7y ago
    > Their breach isn't really a good indicator as I can't think of any/many reasons that most companies would try and do that... There are a bunch of legitimate reasons to run Docker in Docker. The most obvious is in a build pipeline. For example Jenkins does Docker builds in containers all the time.