3 ms·
Right. This is great if you are still learning the ropes. However the title is best practices. Using uid 1000 and using rw file mounts exposes your main user to
by kortex 6y ago
Right. This is great if you are still learning the ropes. However the title is best practices. Using uid 1000 and using rw file mounts exposes your main user to potential exploits. Often 1000 is in the docker group for convenience.
That allows an attacker to potentially append some nasty code outside the container and get password-less sudo. Unlikely? Very. But security is all about layers.
I've seen full-fat Ubuntu containers with uid 1000 which is in docker group on the host and ~ mounted to run some python flask app, in production.
- znpy 6y ago> I've seen full-fat Ubuntu containers with uid 1000 which is in docker group on the host and ~ mounted to run some python flask app, in production If you mount ~ in your containers you have bigger problems than uid 1000.
- wwright 6y agoRunning with uid 1000 in the Docker group in prod is a very bad idea to begin with
- Spivak 6y agoOn your single-user dev laptop it’s very likely that you are user 1000 and probably put yourself in the docker group so you wouldn’t have to sudo to run docker ps. So then running your containers as that UID without user namespacing (docker’s default) opens you up to more attack surface than if it was uid 1001.