3 ms·

I mysteriously stopped needing vmware or virtualbox the year docker came out, I wonder why...

belter 2y ago
"7 Ways to Escape a Container" - https://www.panoptica.app/research/7-ways-to-escape-a-container https://www.panoptica.app/research/7-ways-to-escape-a-contai...
- gettodachoppa 2y ago
  I'm a casual Docker user, ran maybe 30 images my whole life. I've never used any of these flags and didn't know most of them even existed. Are these serious threats? I mean it seems like common sense that if you give a malicious container elevated privileges, it can do bad stuff. Is a VM any different? If you create a VM and add your host's / directory as a share with write permissions (allowing the VM to modify your host filesystem/binaries) does that mean VMs are bad at isolation and shouldn't be used? Because that's what these "7 ways to escaper a container" ways look like to me.
  - belter 2y ago
    Containers are called "Leaky Vessels" for a reason... "Container Escape: New Vulnerabilities Affecting Docker and RunC" - https://www.paloaltonetworks.com/blog/prisma-cloud/leaky-vessels-vulnerabilities-container-escape/ https://www.paloaltonetworks.com/blog/prisma-cloud/leaky-ves... VMs offer a much better isolation mode.
    - gettodachoppa 2y ago
      Thanks, that link made me much more confident in using Docker. I mean come on: "Attackers could try to exploit this issue by causing the user to build two malicious images at the same time, which can be done by poisoning the registry, typosquatting or other methods" So basically ridiculous CVEs that will never affect people not in the habit of building random Dockerfiles off Github with 2 stars. Good to know. Only the 1st one isn't dismissable out of hand, I can't tell if it's bogus like the rest./
- remram 2y ago
  Those are all explicit privileges given to the guest. You can also "escape" from a VM if you give it access to the Docker daemon on the host... It's like saying "2 ways to escape an unprivileged user account: 1. type su then the root password, or 2. convince the admin to setuid your shell"

"7 Ways to Escape a Container" - https://www.panoptica.app/research/7-ways-to-escape-a-container https://www.panoptica.app/research/7-ways-to-escape-a-contai...

gettodachoppa 2y ago
I'm a casual Docker user, ran maybe 30 images my whole life. I've never used any of these flags and didn't know most of them even existed. Are these serious threats? I mean it seems like common sense that if you give a malicious container elevated privileges, it can do bad stuff. Is a VM any different? If you create a VM and add your host's / directory as a share with write permissions (allowing the VM to modify your host filesystem/binaries) does that mean VMs are bad at isolation and shouldn't be used? Because that's what these "7 ways to escaper a container" ways look like to me.
- belter 2y ago
  Containers are called "Leaky Vessels" for a reason... "Container Escape: New Vulnerabilities Affecting Docker and RunC" - https://www.paloaltonetworks.com/blog/prisma-cloud/leaky-vessels-vulnerabilities-container-escape/ https://www.paloaltonetworks.com/blog/prisma-cloud/leaky-ves... VMs offer a much better isolation mode.
  - gettodachoppa 2y ago
    Thanks, that link made me much more confident in using Docker. I mean come on: "Attackers could try to exploit this issue by causing the user to build two malicious images at the same time, which can be done by poisoning the registry, typosquatting or other methods" So basically ridiculous CVEs that will never affect people not in the habit of building random Dockerfiles off Github with 2 stars. Good to know. Only the 1st one isn't dismissable out of hand, I can't tell if it's bogus like the rest./
remram 2y ago
Those are all explicit privileges given to the guest. You can also "escape" from a VM if you give it access to the Docker daemon on the host... It's like saying "2 ways to escape an unprivileged user account: 1. type su then the root password, or 2. convince the admin to setuid your shell"