4 ms·
(cd "$path" && [ "$(pwd -P)" = "$path" ] && chown -R buildkite-agent:buildkite-agent .) the real question though is why they're trusting just Docker alone to i
by Hello71 3y ago
(cd "$path" && [ "$(pwd -P)" = "$path" ] && chown -R buildkite-agent:buildkite-agent .)
the real question though is why they're trusting just Docker alone to isolate customers; if they want the jobs to effectively be a single user to the system, they can even use unprivileged user namespaces?
- lox 3y agoThis stack is run by a single customer on trusted code isolated in their own AWS env. (I wrote it originally 6-7 years back) There are radically better isolation strategies now. Firecracker and/or Sysbox hardened docker containers is one I’ve recently implemented.
- Y_Y 3y agoWhen all you have is a hammer...