4 ms·
Not sure about production workloads but its not just privileged containers you start that should be a concern.. anyone who can access /var/run/docker.sock can r
by tln 7y ago
Not sure about production workloads but its not just privileged containers you start that should be a concern.. anyone who can access /var/run/docker.sock can run a privileged container, so this can be a privilege escalation.
Because of this escape, giving access to /var/run/docker.sock to regular users is the same as giving them root access.
Also as the article says mounting /var/run/docker.sock is (now, because of this escape) the same as giving that container access to the host system.
- mclehman 7y agoOn the other side of things, my favorite demo for people new to docker who aren't yet aware that sudoless docker ~~ root access is: docker run -itv /:/host ubuntu chroot /host
- cyphar 7y agoOr, even better use nsenter to join all the namespaces of PID 1 on the host (making your process an ordinary root process in the init namespaces).
- zapita 7y agoMounting /var/run/docker.sock has always been the same as full host access. That is a well-documented fact irrespective of this particular escape.