4 ms·
Not sure what your comment about docker containers is trying to say. In docker you need to specify port mappings before ports are exposed outside the container,
by kevinsundar 6y ago
Not sure what your comment about docker containers is trying to say. In docker you need to specify port mappings before ports are exposed outside the container, so this wouldn't happen without you explicitly knowing. Containers are by default untrusted and access to network and filesystem is mediated. In fact, if you linked to a docker container I'd have less qualms running than a binary.
- comboy 6y agoYes, you have and that is reasonable. It is assumed that it is safely contained environment that cannot maliciously affect your host system. Yet every virtualization and container solution we've seen so far had been exploited. "But is there a vulnerability at the moment that can be exploited?" "None that we know of" Containers also often get generous access rights and internet access, even assuming container solution being intact. Security of the system inside is a whole big surface of attack that you have little control of (unless you meticulously analyze each docker full fucking system image every time you run them), and necessarily affects your systems because otherwise you would have no use for this container. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=docker https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=docker
- takeda 6y agoThe filesystem is restricted, but network generally not. You can have a malicious container connect to rest of your network. The ports don't need to be open either, it can phone home (like how most bots do). Certain data centers restrict access to outside network (i.e. Internet), with now popular public cloud. It's actually hard to place such restriction, because majority tooling, including official images are expecting to be connected outside.