5 ms·

Everything I've read about Docker has given me the impression that they started seriously worrying about security only after they had already laid out the found

Everything I've read about Docker has given me the impression that they started seriously worrying about security only after they had already laid out the foundations, and that that meant they could never truly make it secure, resulting in lots of security holes that are found on an ongoing basis. Meaning I shouldn't rely on it when security is at stake. Is this wrong?

ChrisSD 7y ago
It would be fairer to say they weren't initially trying to provide a security layer. More like an alternative packaging system that was distro independent. The idea was that such a packaged system should be doing all the security things you'd do if running on the bare operating system. So getting root inside a container would be expected to be as devastating as if the host had been compromised. Admittedly many developers didn't get this memo in the beginning.
- rtempaccount1 7y ago
  So the Docker security team did a lot of work in the early days precisely because people felt that it didn't provide good security isolation. As to root in a container == host compromise, what makes you say that? Absent a Linux kernel vuln. or mistake when running the container that's generally not easily possible. (that's not to say that containers should be run as root, they should not, but that it's not necessarily trivial to breakout of one)
  - ChrisSD 7y ago
    Aye they did a lot of work after people responded to its lack of isolation. My point was that was not a focus initially.
    - o-__-o 7y ago
      I remember the days of docker security check and it was just a hollow stub for future improvement.
- Thaxll 7y ago
  Root in a container is not unsecure, the user mapping is different between what runs the container and what's running inside.
  - ChrisSD 7y ago
    Again, I was talking about Docker's initial security considerations. I think it wasn't until about 1.10(?) that it got user namespacing.
  - supermanfan 7y ago
    No, actually UID=0 in the container is the same root as the host. By default there is no user mapping.
rtempaccount1 7y ago
The Docker team did quite a bit of work (e.g. establishing Apparmor/SELinux profiles, creating seccomp policies, deciding on acceptable capabilities) in the relatively early days of Docker. TBH those haven't changes much in quite a few versions now (AFAIK), so a lot of the foundational work was done early on.
- o-__-o 7y ago
  There was a time when docker was production ready and the security check of containers was merely a stub that acted like it was checking things but didn’t really do anything. Please don’t rewrite history
  - rtempaccount1 7y ago
    I wouldn't suggest I am re-writing history. What's your definition of "production ready"?
paxys 7y ago
Simply because Docker was never supposed to be an isolated sandbox in the first place, rather a way to run trusted code as you normally would, just with consistent and reproducible dependencies.

ChrisSD 7y ago

It would be fairer to say they weren't initially trying to provide a security layer. More like an alternative packaging system that was distro independent. The idea was that such a packaged system should be doing all the security things you'd do if running on the bare operating system. So getting root inside a container would be expected to be as devastating as if the host had been compromised. Admittedly many developers didn't get this memo in the beginning.

rtempaccount1 7y ago
So the Docker security team did a lot of work in the early days precisely because people felt that it didn't provide good security isolation. As to root in a container == host compromise, what makes you say that? Absent a Linux kernel vuln. or mistake when running the container that's generally not easily possible. (that's not to say that containers should be run as root, they should not, but that it's not necessarily trivial to breakout of one)
- ChrisSD 7y ago
  Aye they did a lot of work after people responded to its lack of isolation. My point was that was not a focus initially.
  - o-__-o 7y ago
    I remember the days of docker security check and it was just a hollow stub for future improvement.
Thaxll 7y ago
Root in a container is not unsecure, the user mapping is different between what runs the container and what's running inside.
- ChrisSD 7y ago
  Again, I was talking about Docker's initial security considerations. I think it wasn't until about 1.10(?) that it got user namespacing.
- supermanfan 7y ago
  No, actually UID=0 in the container is the same root as the host. By default there is no user mapping.

rtempaccount1 7y ago

The Docker team did quite a bit of work (e.g. establishing Apparmor/SELinux profiles, creating seccomp policies, deciding on acceptable capabilities) in the relatively early days of Docker. TBH those haven't changes much in quite a few versions now (AFAIK), so a lot of the foundational work was done early on.

o-__-o 7y ago
There was a time when docker was production ready and the security check of containers was merely a stub that acted like it was checking things but didn’t really do anything. Please don’t rewrite history
- rtempaccount1 7y ago
  I wouldn't suggest I am re-writing history. What's your definition of "production ready"?

paxys 7y ago

Simply because Docker was never supposed to be an isolated sandbox in the first place, rather a way to run trusted code as you normally would, just with consistent and reproducible dependencies.