3 ms·
Except giving access to a docker daemon equals giving the root access to the machine because it's easy to do something such as : $ docker run -it -v /:/hostfs
by hclaria 7y ago
Except giving access to a docker daemon equals giving the root access to the machine
because it's easy to do something such as :
$ docker run -it -v /:/hostfs debian chroot /hostfs
# I'm root !
- the8472 7y agoThe issue is an unprivileged container fooling the host, not the host intentionally escalating to root.
- Leynos 7y agoIndeed. The point discussed in the grandparent relates to indirect access to the daemon. E.g., a process (not under direct user control) communicating with the Docker daemon via http API. The point being that the cp endpoint can be compromized without the user having direct control over the API parameters.