3 ms·

Would running vscode in docker/podman mitigate the risk? When I started using VSCode I was a bit worried about potentially unwanted network traffic originating

Would running vscode in docker/podman mitigate the risk? When I started using VSCode I was a bit worried about potentially unwanted network traffic originating from VSCode and for that reason I'm executing it from podman container without routing to the internet.

dijit 4y ago
Docker and Podman are not security countermeasures. They appear as such accidentally through controlling resources and visibility of the filesystem. Docker and Podman solve the "isolated environment for development so I can control my dependencies", "package management" and "reproducible environment" problems; which is already a lot. We should not pretend that it's doing more than it is; since it is already covering many important topics and it muddies the conversation. The reason I'm being so detailed is that there are a contingent of people who will swear to death that Docker is a security layer: but notably none of them are ever security engineers.
- vscodeuser 4y ago
  I agree with original intent behind docker. But is the idea of unix namespaces not serving wider purpose than what docker/podman is delivering..? If process in question is contained within namespace then would it not be enough to stop the exploit of process in question from doing harm to your system? I assume the bad actor would not combine such exploit with, say, kernel exploit enabling to escape unix namespace.
- kevinsundar 4y ago
  Well containers use security features in the kernel by definition in their implementations. It’s pretty easy to make an argument that containers are a security layer especially in their default state. When you start adding capabilities and patching through the docker socket then things get insecure real quick.
  - dijit 4y ago
    You can use similar primitives that docker is using to achieve security hardening. Even docker themselves have a detailed dossier of documents saying they’re not a security layer (but that they’d like to be). From FAQ: > Is Docker a secure platform? > The Docker platform itself isn’t inherently secure or insecure. While containers may be isolated from other processes on a host, additional security measures are still crucial to prevent container breakout and other types of vulnerabilities. An effective container security strategy for building and deploying containers is the best way to reduce the risk of a vulnerability, and in turn, an attack. Just like any other technology platform, following security best practices is the key to mitigating potential threats.
- deleted 4y ago
  [deleted]

dijit 4y ago

Docker and Podman are not security countermeasures. They appear as such accidentally through controlling resources and visibility of the filesystem. Docker and Podman solve the "isolated environment for development so I can control my dependencies", "package management" and "reproducible environment" problems; which is already a lot. We should not pretend that it's doing more than it is; since it is already covering many important topics and it muddies the conversation. The reason I'm being so detailed is that there are a contingent of people who will swear to death that Docker is a security layer: but notably none of them are ever security engineers.

vscodeuser 4y ago
I agree with original intent behind docker. But is the idea of unix namespaces not serving wider purpose than what docker/podman is delivering..? If process in question is contained within namespace then would it not be enough to stop the exploit of process in question from doing harm to your system? I assume the bad actor would not combine such exploit with, say, kernel exploit enabling to escape unix namespace.
kevinsundar 4y ago
Well containers use security features in the kernel by definition in their implementations. It’s pretty easy to make an argument that containers are a security layer especially in their default state. When you start adding capabilities and patching through the docker socket then things get insecure real quick.
- dijit 4y ago
  You can use similar primitives that docker is using to achieve security hardening. Even docker themselves have a detailed dossier of documents saying they’re not a security layer (but that they’d like to be). From FAQ: > Is Docker a secure platform? > The Docker platform itself isn’t inherently secure or insecure. While containers may be isolated from other processes on a host, additional security measures are still crucial to prevent container breakout and other types of vulnerabilities. An effective container security strategy for building and deploying containers is the best way to reduce the risk of a vulnerability, and in turn, an attack. Just like any other technology platform, following security best practices is the key to mitigating potential threats.
deleted 4y ago
[deleted]