5 ms·
I think we must be careful not to use no-true-scotsman here. Imo, an attack should be considered valid if it works against a typical config - one you would arri
by im3w1l 3y ago
I think we must be careful not to use no-true-scotsman here. Imo, an attack should be considered valid if it works against a typical config - one you would arrive at following a popular tutorial, rather than requiring that it must work against an ideal config.
- charcircuit 3y agoThe definition of escaping a container (namespace) is being able to interact with resources not in the namespaces of the process. If a process's network namespace contains a network device then it is not an escape to use it by definition. If the network namespace for a process contains no devices then being able to use a network device would be an escape.
- lmeyerov 3y agoSpecifying networks is one of the main docker compose commands and seems pretty normal: services: your_service: image: your_image networks: isolated_network: another_service: image: another_image # This service is on the default network I'd be curious how a vanilla (actual) networking setup is full of holes...