4 ms·

If you've got root on a container, depending on how it's configured, you can gain access to the host in some situations (eg. Using volumes)

foldr 6y ago
But non-root users within the container can also access mounted volumes, no? Is there some kind of exploit that only works if running as root?
- lights0123 6y ago
  You can setuid root in a volume mounted in host. If that's executed at all by any user, bam you have root on the host. If it's never executed, I don't know what vulnerabilities they were talking about.
  - foldr 6y ago
    Right, but it seems that wouldn't require the app within the Docker container to be running as root to work?
nix23 6y ago
What a shitty concept. Typical Linux NIH (learn from zones jails lpar...no we need to reinvent the wheel in square format)
- turminal 6y ago
  Linux namespaces are quite flexible and aren't used just for docker style containerization. In some use cases having a shared user namespace makes sense. Docker just doesn't use the provided interface by default. Which is a shame because a lot of users don't bother or don't know they should bother to configure it. I think that's kind of a 'we don't care about security' move by docker and given its userbase that's a real problem.
  - nix23 6y ago
    Hmm, i come from a Solaris/BSD background, Jailing (or containerize) a application was all about security, second manageability, and third re-usability. Kind of crazy that Docker ignored the most important thing in the Container-Concept (which can be, run un-trusted code on your trusted platform.)
    - tannhaeuser 6y ago
      Docker really is a power tool for developers, especially for freelancers needing to hop customer environments on their own notebook, and excels at that. The problem is the leap of pushing this guerilla tactics into running containers in prod. It's a result of the "move fast and break shit", web-scale, startup, and other agile narrative of the 2010s. And the industry has sure catered for these consumerisation of IT, with outlandish complexity in k8s, depressing oligopolization, and younger developers demanding such technologies to pad their resumes.
      - nix23 6y ago
        One of the most outraging thing i seen in the past: Docker-host as a VM (for security) i mean WTF!!

foldr 6y ago

But non-root users within the container can also access mounted volumes, no? Is there some kind of exploit that only works if running as root?

lights0123 6y ago
You can setuid root in a volume mounted in host. If that's executed at all by any user, bam you have root on the host. If it's never executed, I don't know what vulnerabilities they were talking about.
- foldr 6y ago
  Right, but it seems that wouldn't require the app within the Docker container to be running as root to work?

nix23 6y ago

What a shitty concept. Typical Linux NIH (learn from zones jails lpar...no we need to reinvent the wheel in square format)

turminal 6y ago
Linux namespaces are quite flexible and aren't used just for docker style containerization. In some use cases having a shared user namespace makes sense. Docker just doesn't use the provided interface by default. Which is a shame because a lot of users don't bother or don't know they should bother to configure it. I think that's kind of a 'we don't care about security' move by docker and given its userbase that's a real problem.
- nix23 6y ago
  Hmm, i come from a Solaris/BSD background, Jailing (or containerize) a application was all about security, second manageability, and third re-usability. Kind of crazy that Docker ignored the most important thing in the Container-Concept (which can be, run un-trusted code on your trusted platform.)
  - tannhaeuser 6y ago
    Docker really is a power tool for developers, especially for freelancers needing to hop customer environments on their own notebook, and excels at that. The problem is the leap of pushing this guerilla tactics into running containers in prod. It's a result of the "move fast and break shit", web-scale, startup, and other agile narrative of the 2010s. And the industry has sure catered for these consumerisation of IT, with outlandish complexity in k8s, depressing oligopolization, and younger developers demanding such technologies to pad their resumes.
    - nix23 6y ago
      One of the most outraging thing i seen in the past: Docker-host as a VM (for security) i mean WTF!!