4 ms·

> I especially don't believe in kluges to the effect of 'superuser doesn't have all permissions anymore' This comes from a postgres developer? Postgres is the

by nh2 2y ago

> I especially don't believe in kluges to the effect of 'superuser doesn't have all permissions anymore' This comes from a postgres developer? Postgres is the only software I know that has a hardcode that forbids running as root: "root" execution of the PostgreSQL server is not permitted. The server must be started under an unprivileged user ID to prevent possible system security compromise. There is no option to disable that. I think that's bad. You: "But I want to run postgres isolated in a single user VM or container or unshare where only root exists, which has much stronger security guarantees that UNIX user separation!" Postgres: "Forget about it, those things don't exist, this is the 70s." I hope somebody patches that out.

parhamn 2y ago
I haven't looked this up in a few years, but is it still bad practice to run things as root in docker? There was always a fear in the community that running things as root would make the path easier if a hypothetical jailbreak were to occur. It always felt like "Buy our kevlar vest, but maybe pack some chainmail underneath. Just incase."
- nightowl_games 2y ago
  I really don't like how any files docker writes to the host will be owned by root if you run docker as root. Creating files in a VSCode dev container creates them as root and I really don't like that.
  - XorNot 2y ago
    This is what user namespaces are for. Files written as "root" in the container are written as the host user.
- lolinder 2y ago
  > It always felt like "Buy our kevlar vest, but maybe pack some chainmail underneath. Just incase. My understanding of Docker has always been that you're not supposed to rely on it for security—it's less a kevlar vest and more a build-your-own-platemail tinker toy set. If you know what you're doing you can create a quite secure environment with it, but if you don't you're not that much better off than running stuff directly on an EC2 instance. Some practices that help secure your image are running a stripped-down image (fewer binaries to call out to if an attacker achieves RCE) and being judicious in volumes and network settings. But yeah, I'd definitely also prefer to see the container running rootless. It's all about reducing what an attacker can do if they get to RCE, and root still plays a role in that.
- akvadrako 2y ago
  It's certainly fine for rootless docker, since root in the container is your usually your regular user outside it.

by nh2 2y ago

parhamn 2y ago

I haven't looked this up in a few years, but is it still bad practice to run things as root in docker? There was always a fear in the community that running things as root would make the path easier if a hypothetical jailbreak were to occur. It always felt like "Buy our kevlar vest, but maybe pack some chainmail underneath. Just incase."

nightowl_games 2y ago
I really don't like how any files docker writes to the host will be owned by root if you run docker as root. Creating files in a VSCode dev container creates them as root and I really don't like that.
- XorNot 2y ago
  This is what user namespaces are for. Files written as "root" in the container are written as the host user.
lolinder 2y ago
> It always felt like "Buy our kevlar vest, but maybe pack some chainmail underneath. Just incase. My understanding of Docker has always been that you're not supposed to rely on it for security—it's less a kevlar vest and more a build-your-own-platemail tinker toy set. If you know what you're doing you can create a quite secure environment with it, but if you don't you're not that much better off than running stuff directly on an EC2 instance. Some practices that help secure your image are running a stripped-down image (fewer binaries to call out to if an attacker achieves RCE) and being judicious in volumes and network settings. But yeah, I'd definitely also prefer to see the container running rootless. It's all about reducing what an attacker can do if they get to RCE, and root still plays a role in that.
akvadrako 2y ago
It's certainly fine for rootless docker, since root in the container is your usually your regular user outside it.