4 ms·
I haven't looked this up in a few years, but is it still bad practice to run things as root in docker? There was always a fear in the community that running thi
by parhamn 2y ago
I haven't looked this up in a few years, but is it still bad practice to run things as root in docker? There was always a fear in the community that running things as root would make the path easier if a hypothetical jailbreak were to occur. It always felt like "Buy our kevlar vest, but maybe pack some chainmail underneath. Just incase."
- nightowl_games 2y agoI really don't like how any files docker writes to the host will be owned by root if you run docker as root. Creating files in a VSCode dev container creates them as root and I really don't like that.
- XorNot 2y agoThis is what user namespaces are for. Files written as "root" in the container are written as the host user.
- lolinder 2y ago> It always felt like "Buy our kevlar vest, but maybe pack some chainmail underneath. Just incase. My understanding of Docker has always been that you're not supposed to rely on it for security—it's less a kevlar vest and more a build-your-own-platemail tinker toy set. If you know what you're doing you can create a quite secure environment with it, but if you don't you're not that much better off than running stuff directly on an EC2 instance. Some practices that help secure your image are running a stripped-down image (fewer binaries to call out to if an attacker achieves RCE) and being judicious in volumes and network settings. But yeah, I'd definitely also prefer to see the container running rootless. It's all about reducing what an attacker can do if they get to RCE, and root still plays a role in that.
- akvadrako 2y agoIt's certainly fine for rootless docker, since root in the container is your usually your regular user outside it.