5 ms·
While container breakouts do happen, they're pretty rare. I'd be more concerned about any potential injection vectors in the go code, which could lead to a clou
by iueotnmunto 4y ago
While container breakouts do happen, they're pretty rare. I'd be more concerned about any potential injection vectors in the go code, which could lead to a cloud breach if you're not careful ;)
- adamgordonbell 4y agoOh interesting. What were you imagining as the injection vector? The earthly backend runs on a modified buildkit so it is running the arbitrary code in a container, but it's also in its own VM. This was simpler then firecracker to get started but turned out to have pretty good performance and alright cost once we started suspending things.
- iueotnmunto 4y agoMore if you're running `provision --vm-name "$UserSuppliedData"` or similar. I don't know how you've built your wrapping tool, so I can't comment on how likely it would be, but I've seen such breakages IRL (I break things for a living ;) )
- brandonschurman 4y agoGood point, we do have things locked down pretty well in our go code though. The instances can only be provisioned using an API, and that API doesn't allow for arbitrary user-supplied input.
- raesene9 4y agoThere have been a bunch of Linux kernel privesc vulns that can be converted to container breakouts from standard Linux containers, just look at bounties from Google's kCTF (AFAIK they've had 10 different kernel vulns in 2 years) It's possible to mitigate/reduce them for sure, with appropriate hardening, but the Linux kernel is still quite a big attack surface.
- deleted 4y ago[deleted]
- flangola7 4y agoWhat about kernels like seL4? I think everyone will abandon monolithic kernels one day because they have too much attack surface.
- yjftsjthsd-h 4y agoIs anyone running normal workloads (node/java/php/python/whatever) on seL4 without sticking Linux in the middle?