4 ms·

Defaults on Docker specifically are pretty locked down. Even if if the container process has the root uid it is not able to do most things normal root can do, a

Defaults on Docker specifically are pretty locked down. Even if if the container process has the root uid it is not able to do most things normal root can do, and is pretty much limited to being able to access root owned files and binding to privileged ports (which in a container doesn't tend to matter).

yjftsjthsd-h 3y ago
> Defaults on Docker specifically are pretty locked down. That is strongly dependent on your threat model. The default docker configuration completely bypasses the firewall, making it trivial for containers to be exposed to the open internet with no way for admins to prevent it[0]. Likewise, I hesitate to call docker's default of running as root safe since it means anyone with access to the docker socket immediately has root on the host. [0] It is quite easy for someone even slightly inexperienced to accidentally write, say `-p 1234:1234` instead of `-p 127.0.0.1:1234:1234` and thereby cause a security incident or near-miss; ask me how I know.
- cpuguy83 3y ago
  Docker has to run as root, or use otherwise insecure methods ("rootless" is a sham, it requires suid binaries and CVE ridden unprivileged user namespaces). I agree with ports, working[0][1][2] on it. [0] https://github.com/moby/moby/discussions/45524 https://github.com/moby/moby/discussions/45524 [1] https://github.com/moby/moby/issues/45532 https://github.com/moby/moby/issues/45532 [2] https://github.com/moby/moby/pull/45076 https://github.com/moby/moby/pull/45076
  - cpuguy83 3y ago
    That said, docker does have support for running "rootless"
- ipdashc 3y ago
  > Likewise, I hesitate to call docker's default of running as root safe since it means anyone with access to the docker socket immediately has root on the host. I never got why this is commonly used as an argument against Docker, TBH. You just don't give out access to the Docker socket to anything untrusted. Doesn't pretty much everyone know that by now? I feel like people always say Docker is awfully insecure, but then the proofs-of-concept include flags like `--privileged`, or the socket is mounted, or / is mounted, or --net=host is set... etc. Docker by default always seemed pretty good to me, but I'm not very experienced in that realm, so I'm just wondering what I'm missing.

yjftsjthsd-h 3y ago

> Defaults on Docker specifically are pretty locked down. That is strongly dependent on your threat model. The default docker configuration completely bypasses the firewall, making it trivial for containers to be exposed to the open internet with no way for admins to prevent it[0]. Likewise, I hesitate to call docker's default of running as root safe since it means anyone with access to the docker socket immediately has root on the host. [0] It is quite easy for someone even slightly inexperienced to accidentally write, say `-p 1234:1234` instead of `-p 127.0.0.1:1234:1234` and thereby cause a security incident or near-miss; ask me how I know.

cpuguy83 3y ago
Docker has to run as root, or use otherwise insecure methods ("rootless" is a sham, it requires suid binaries and CVE ridden unprivileged user namespaces). I agree with ports, working[0][1][2] on it. [0] https://github.com/moby/moby/discussions/45524 https://github.com/moby/moby/discussions/45524 [1] https://github.com/moby/moby/issues/45532 https://github.com/moby/moby/issues/45532 [2] https://github.com/moby/moby/pull/45076 https://github.com/moby/moby/pull/45076
- cpuguy83 3y ago
  That said, docker does have support for running "rootless"
ipdashc 3y ago
> Likewise, I hesitate to call docker's default of running as root safe since it means anyone with access to the docker socket immediately has root on the host. I never got why this is commonly used as an argument against Docker, TBH. You just don't give out access to the Docker socket to anything untrusted. Doesn't pretty much everyone know that by now? I feel like people always say Docker is awfully insecure, but then the proofs-of-concept include flags like `--privileged`, or the socket is mounted, or / is mounted, or --net=host is set... etc. Docker by default always seemed pretty good to me, but I'm not very experienced in that realm, so I'm just wondering what I'm missing.