3 ms·
if it works for LXC containers shouldn't it also work for unprivileged (but non VM) docker containers?
by dathinab 3y ago
if it works for LXC containers shouldn't it also work for unprivileged (but non VM) docker containers?
- Unroll0201 3y agoThis is an educated guess, but I believe unprivileged Docker containers cannot create (user) namespaces. Hence, the vulnerability cannot be triggered, since the exploit requires interaction with nf_tables, which requires (namespace) root. LXC containers and privileged Docker containers allow these namespaces to be made inside of them, whilst unprivileged Docker containers do not.