3 ms·
If I have 30 containers running, why should a single daemon being restarted cause all 30 to shutdown as well? Similarly, the docker security model is that ther
by georgyo 6y ago
If I have 30 containers running, why should a single daemon being restarted cause all 30 to shutdown as well?
Similarly, the docker security model is that there isn't a security model. If you can talk to the docker socket you have what ever privileges the daemon is running as.
- raesene9 6y agoSo Docker supports live restore https://docs.docker.com/config/containers/live-restore/ https://docs.docker.com/config/containers/live-restore/ which addresses the first point. Second point, yep if you run Docker as root and someone can access the socket file they get root. If that's a concern, you can run Docker rootless. And as we're talking file permissions on a local host to allow that access, the same applies to podman containers does it not? If there are permission issues allowing another user to use access the container filesystems, you have the same problem.
- zaarn 6y agoRootless Docker is basically a joke, I've tried to run production workloads on it for about a year before I gave up. Numerous docker images will refuse to work, a bunch of things will subtly fill your error logs with warnings and it doesn't mesh well with running docker swarm at all.
- raesene9 6y agoRootless docker only left experimental status with 20.10 which came out in December 2020, so maybe they would have addressed some of those issues... As to swarm, I was comparing Docker rootless to podman, which is more a developer use case than prod. container clusters.