3 ms·

Is the Docker daemon actually a huge security hole? I see people championing Podman because it's daemonless but is it actually beneficial or is it championed b

by Jonnax 6y ago

Is the Docker daemon actually a huge security hole? I see people championing Podman because it's daemonless but is it actually beneficial or is it championed because it's Red Hat and a case of security check boxing?

choeger 6y ago
It certainly is a gaping hole. But the machines that docker runs on in my experience have a 100% sudoers ratio, so the practical impact is limited.
- yjftsjthsd-h 6y ago
  Do you mean in that adding a user to the docker group is effectively handing them root? Because if you don't do that, then running docker requires root/sudo, which means that it should be exactly as secure as anything else
eeZah7Ux 6y ago
> Is the Docker daemon actually a huge security hole? Yes. Also the containers on docker hub are a security dumpster fire.
soraminazuki 6y ago
It's a root daemon which can be made to run arbitrary commands by anyone using its interface, so yes it is a huge, huge security burden. You can't just brush that off as a superficial problem.
- educar 6y ago
  Given that the most common case is running docker in server environments in VMs and the sysadmins are root, is this a real issue? Can you tell me an environment where a multi-tenant system runs docker?
  - soraminazuki 6y ago
    Yes, it[1] is[2] a[3] real[4] issue[5] which leads to privilege escalation bugs. It also doesn't help that most containers that Docker is responsible for managing is supposed to be unprivileged, and Docker itself is commonly used as a component for a multi-tenant container runtime. [1] https://www.cvedetails.com/cve/CVE-2019-15752/ https://www.cvedetails.com/cve/CVE-2019-15752/ [2] https://www.cvedetails.com/cve/CVE-2019-14271/ https://www.cvedetails.com/cve/CVE-2019-14271/ [3] https://www.cvedetails.com/cve/CVE-2019-5736/ https://www.cvedetails.com/cve/CVE-2019-5736/ [4] https://www.cvedetails.com/cve/CVE-2018-15664/ https://www.cvedetails.com/cve/CVE-2018-15664/ [5] https://www.cvedetails.com/cve/CVE-2018-15514/ https://www.cvedetails.com/cve/CVE-2018-15514/

by Jonnax 6y ago

choeger 6y ago

It certainly is a gaping hole. But the machines that docker runs on in my experience have a 100% sudoers ratio, so the practical impact is limited.

yjftsjthsd-h 6y ago
Do you mean in that adding a user to the docker group is effectively handing them root? Because if you don't do that, then running docker requires root/sudo, which means that it should be exactly as secure as anything else

eeZah7Ux 6y ago

> Is the Docker daemon actually a huge security hole? Yes. Also the containers on docker hub are a security dumpster fire.

soraminazuki 6y ago

It's a root daemon which can be made to run arbitrary commands by anyone using its interface, so yes it is a huge, huge security burden. You can't just brush that off as a superficial problem.

educar 6y ago
Given that the most common case is running docker in server environments in VMs and the sysadmins are root, is this a real issue? Can you tell me an environment where a multi-tenant system runs docker?
- soraminazuki 6y ago
  Yes, it[1] is[2] a[3] real[4] issue[5] which leads to privilege escalation bugs. It also doesn't help that most containers that Docker is responsible for managing is supposed to be unprivileged, and Docker itself is commonly used as a component for a multi-tenant container runtime. [1] https://www.cvedetails.com/cve/CVE-2019-15752/ https://www.cvedetails.com/cve/CVE-2019-15752/ [2] https://www.cvedetails.com/cve/CVE-2019-14271/ https://www.cvedetails.com/cve/CVE-2019-14271/ [3] https://www.cvedetails.com/cve/CVE-2019-5736/ https://www.cvedetails.com/cve/CVE-2019-5736/ [4] https://www.cvedetails.com/cve/CVE-2018-15664/ https://www.cvedetails.com/cve/CVE-2018-15664/ [5] https://www.cvedetails.com/cve/CVE-2018-15514/ https://www.cvedetails.com/cve/CVE-2018-15514/