6 ms·

Root your Docker host in 10 seconds for fun and profit (2017)

71 points by agomez314 2y ago

willejs 2y ago
One thing that always surprises me, is that people havn't made more of a fuss about docker for mac. By default on install it shares the whole hard disk (unless thats changed), meaning without sudo you can get privileged access to the whole filesystem. I scope it down to my user folder, but the defaults are dangerous.
- beeboobaa3 2y ago
  Do you also think running any regular software is "dangerous"? Because that gets to access your disk as well. Docker is not for security isolation, it is for distributing apps so they'll even run on your mac.
  - anais9 2y ago
    While your point about Docker’s primary purpose is valid, containerization is commonly used for security isolation as well. With proper configuration, it can be very useful towards this end. Can you suggest any preferred alternative methods of isolation that offer similar efficacy and ease of use for quickly running complete software systems made by an unknown/untrusted actor?
    - beeboobaa3 2y ago
      > With proper configuration, it can be very useful towards this end. It can. I think it's fair to assume that the standard developer setup to let them be productive is not this proper configuration. > Can you suggest any preferred alternative methods of isolation that offer similar efficacy and ease of use for quickly running complete software systems made by an unknown/untrusted actor? No. It's a hard problem! If it was easily solved we wouldn't be seeing all this development surrounding e.g. WebAssembly
    - goodpoint 2y ago
      containerization is commonly MISused for security isolation
    - DEADMINCE 2y ago
      Bubblewrap, Firejail, SELinux, etc
  - zmgsabst 2y ago
    Docker has had security and isolation features since it was competing with LXC on who glued cgroups and namespaces together better — and discussed in those terms the whole time. While I agree that Docker as written isn’t good at security, your post has big “they’re holding the iPhone wrong!” vibes — and seemingly ignores the historic reasons that people would think it provides security.
    - beeboobaa3 2y ago
      > your post has big “they’re holding the iPhone wrong!” vibes More like "it just isn't meant to be used for that". At least not in the default configuration, and that's fine! > seemingly ignores the historic reasons that people would think it provides security I've been using docker since it was announced. People have always been very clear that docker is not a security boundary, at least not with its default configuration.
      - gtirloni 2y ago
        I think your point is valid. Docker was indeed all about developer productivity in the beginning and it's up to infrastructure operator to lock it down.
      - zmgsabst 2y ago
        > People have always been very clear that docker is not a security boundary, at least not with its default configuration. I’ve also used it since the beginning and that’s some mighty strong revisionism. Docker was compared to VMs — with a tiny asterisk of fine print that it’s not actually configured to employ security features it’s built with.
        beeboobaa3 2y ago
        > Docker was compared to VMs By certain people, yes. They have always been wrong. Never by the docker team themselves.
ryan-duve 2y ago
For anyone turned off by the title, here's the first sentence: > Disclaimer: There is no actual profit. That was just one of those clickbaity things everybody seems to like so much these days. Also, it’s not really fun. Alright, on with the show!
- cpach 2y ago
  In case you didn’t recognize the trope: It’s a reference to the seminal article ‘Smashing the stack for fun and profit’ by Aleph One. Published in Phrack #49, 1996. IIUC that was the article that introduced the concept of buffer overflow exploits to a wider audience. People have been writing ‘X for fun and profit’ headlines ever since. http://phrack.org/issues/49/1.html http://phrack.org/issues/49/1.html
  - orwin 2y ago
    Also, i think this idiom sound nice, and add disambiguation to the sentence ("Root your docker host" can mean something totally different than the OP title)
    - kaashif 2y ago
      What is the other meaning of "Root your docker host" which is disambiguated by adding "for fun and profit"?
      - edward28 2y ago
        If you say it with an Aussie accent.
      - orwin 2y ago
        I guess "Enable root on your docker host" was my idea (i'm still a VM guy, i don't know if it make sense on docker, but you never know)
  - phrotoma 2y ago
    Arcane wisdom. A friend gave me this printed on tractor paper in the 90's and blew my tiny mind.
eternauta3k 2y ago
If there's basically no security, it would be more honest to do away with the "docker" group and just say that you need to give root to all docker users.
- woodrowbarlow 2y ago
  this is why, when you install docker, it doesn't add any users to the group automatically. it's an extra "post-installation step" listed in the documentation, with a big warning flag explaining that this is effectively equivalent to handing out root. https://docs.docker.com/engine/install/linux-postinstall/ https://docs.docker.com/engine/install/linux-postinstall/
- slayerjain 2y ago
  I think this is the reason docker on linux requires appending sudo to the command by default. Creating a docker group and adding the user to the docker group to avoid sudo is more of a convenience thing, and the implication seems to be well documented now - https://docs.docker.com/engine/install/linux-postinstall/ https://docs.docker.com/engine/install/linux-postinstall/ so if someone sacrificed convenience over security, I think the authors can't do much. Also I think there's no such thing as secure vs non-secure product, instead its levels of security.
  - slayerjain 2y ago
    Thanks to who ever upvoted my comment. Someone had downvoted me (╥﹏╥)
- dathinab 2y ago
  It is for me also still a irritating wonder why most Linux distros ship docker like they do (which often doesn't include the docker group but sets it up in a way where it's likely users end up using it, and security warnings related to it are often more then lacking). I mean they could ship rootless docker by default, like podman defaults to rootless (or other by now possible more secure non default setups). Also if you care you probably want to combine rootless (or non-rootless but still user namespace using) docker with a linux secure module setup like SELinux, as it can make security vulnerabilities in rootless docker (and well docker in general) much harder to exploit.
xyst 2y ago
Likely the reason why “rootless mode” docker exists https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/ Noteworthy alternate: podman
- pella 2y ago
  https://podman.io/ https://podman.io/ "Rootless containers allow you to contain privileges without compromising functionality."
  - vdfs 2y ago
    Also Podman doesn't require a daemon
    - stingraycharles 2y ago
      This is the biggest part imho. Podman just inherits the permissions of the current user, which makes things so much easier to reason about from a security perspective.
raesene9 2y ago
For an even earlier reference (2015) "the most pointless docker command ever" https://zwischenzugs.com/2015/06/24/the-most-pointless-docker-command-ever/ https://zwischenzugs.com/2015/06/24/the-most-pointless-docke... This is a by design part of Docker's operation. What's perhaps a little more surprising (though it shouldn't be) is that anyone with create pod rights in a k8s cluster can do this by default on every worker node in the cluster. (unless the cluster operator or provider has implemented additional controls)
f0e4c2f7 2y ago
Does this still work?
- slayerjain 2y ago
  Not by default. But if a docker group is created and the non root user is intentionally added to docker group despite ignoring the warnings in red here - https://docs.docker.com/engine/install/linux-postinstall https://docs.docker.com/engine/install/linux-postinstall then yes :)
deleted 2y ago
[deleted]
sunshine-o 2y ago
My pet theory is that open source is very much about packaging things. I remember being amazed when I discovered that there was this a system, called GNU/Linux, where everything you need was already packaged and easy to install. Then came the Maven, npm & co. Docker (and containers) is basically an universal package manager that was fulled by the success of open source, the arrival of a lot of new people (working on Mac and Windows) in that space and the adoption of the cloud. Docker Hub became the open source "app store". The crime is the misleading term "container" because I bet a majority of people assume there is some security guarantee by design, what is absolutely false. Actually container security is pretty hard and a most people don't really care because it doesn't run on their computer but in the cloud. My guess is something like Kata containers, compatible with the container standards while leveraging hardware virtualization technology will prevail. Or a cleaner system, similar to NixOS/Guix but easier to use, will appear.
Gasp0de 2y ago
I don't get why this is supposed to be a big thing, I thought it was commonly known. This doesn't mean that people can get root from inside a docker container, just that anyone who is allowed to create and start docker containers on a machine can also get root on that machine.
znpy 2y ago
This article is from 2017. Rootless docker is still not the default choice somehow. Podman however has been working rootlessly for a few years now, and does not suffer from many of the docker shortcomings.
- HankB99 2y ago
  > and does not suffer from many of the docker shortcomings. Would you care to elaborate on the shortcomings? I use Docker in my home lab and have taken a couple runs at Podman but have not been highly motivated and reverted to Docker rather than fiddle with things to get my containers working. If I were aware of significant benefits for my usage, I might be inclined to keep trying. If the benefits are more relevant to enterprise or cloud environs, it probably does not matter much to me. My use cases include Gitea (git server) which opens privileged ports inside the container that get mapped to unprivileged ports on the host and I believe that was a problem area. Thanks!
  - worksonmine 2y ago
    > opens privileged ports inside the container that get mapped to unprivileged ports on the host You can either allow those ports to be mapped on your host, or you can map a higher port on the host 8000:80 or 4443:443. I did the former. The biggest problem I have with docker other than root is that it touches the firewall for convenience. Any port you map on the host will be opened in nftables, as per the documentation[1]. Very dangerous default that few developers realize is a problem. You probably only want 80/443 open and proxy your subdomains on the host, but all ports are now exposed to the internet. [1]: https://docs.docker.com/network/#published-ports https://docs.docker.com/network/#published-ports
    - HankB99 2y ago
      > Any port you map on the host will be opened in nftables ... That rates a "Wow!" but seems like something more important to Enterprise/Cloud. It seems like it would be a Bad Thing to open a port because a DB server ran in a different container. That's not something that should be opened unless the DB is on a different host (VM) from an application that uses the DB. In my case I have a firewall/router protecting my home LAN and don't generally run firewalls on individual hosts.

71 points by agomez314 2y ago

One thing that always surprises me, is that people havn't made more of a fuss about docker for mac. By default on install it shares the whole hard disk (unless thats changed), meaning without sudo you can get privileged access to the whole filesystem. I scope it down to my user folder, but the defaults are dangerous.

beeboobaa3 2y ago
Do you also think running any regular software is "dangerous"? Because that gets to access your disk as well. Docker is not for security isolation, it is for distributing apps so they'll even run on your mac.
- anais9 2y ago
  While your point about Docker’s primary purpose is valid, containerization is commonly used for security isolation as well. With proper configuration, it can be very useful towards this end. Can you suggest any preferred alternative methods of isolation that offer similar efficacy and ease of use for quickly running complete software systems made by an unknown/untrusted actor?
  - beeboobaa3 2y ago
    > With proper configuration, it can be very useful towards this end. It can. I think it's fair to assume that the standard developer setup to let them be productive is not this proper configuration. > Can you suggest any preferred alternative methods of isolation that offer similar efficacy and ease of use for quickly running complete software systems made by an unknown/untrusted actor? No. It's a hard problem! If it was easily solved we wouldn't be seeing all this development surrounding e.g. WebAssembly
  - goodpoint 2y ago
    containerization is commonly MISused for security isolation
  - DEADMINCE 2y ago
    Bubblewrap, Firejail, SELinux, etc
- zmgsabst 2y ago
  Docker has had security and isolation features since it was competing with LXC on who glued cgroups and namespaces together better — and discussed in those terms the whole time. While I agree that Docker as written isn’t good at security, your post has big “they’re holding the iPhone wrong!” vibes — and seemingly ignores the historic reasons that people would think it provides security.
  - beeboobaa3 2y ago
    > your post has big “they’re holding the iPhone wrong!” vibes More like "it just isn't meant to be used for that". At least not in the default configuration, and that's fine! > seemingly ignores the historic reasons that people would think it provides security I've been using docker since it was announced. People have always been very clear that docker is not a security boundary, at least not with its default configuration.
    - gtirloni 2y ago
      I think your point is valid. Docker was indeed all about developer productivity in the beginning and it's up to infrastructure operator to lock it down.
    - zmgsabst 2y ago
      > People have always been very clear that docker is not a security boundary, at least not with its default configuration. I’ve also used it since the beginning and that’s some mighty strong revisionism. Docker was compared to VMs — with a tiny asterisk of fine print that it’s not actually configured to employ security features it’s built with.
      - beeboobaa3 2y ago
        > Docker was compared to VMs By certain people, yes. They have always been wrong. Never by the docker team themselves.

ryan-duve 2y ago

For anyone turned off by the title, here's the first sentence: > Disclaimer: There is no actual profit. That was just one of those clickbaity things everybody seems to like so much these days. Also, it’s not really fun. Alright, on with the show!

cpach 2y ago
In case you didn’t recognize the trope: It’s a reference to the seminal article ‘Smashing the stack for fun and profit’ by Aleph One. Published in Phrack #49, 1996. IIUC that was the article that introduced the concept of buffer overflow exploits to a wider audience. People have been writing ‘X for fun and profit’ headlines ever since. http://phrack.org/issues/49/1.html http://phrack.org/issues/49/1.html
- orwin 2y ago
  Also, i think this idiom sound nice, and add disambiguation to the sentence ("Root your docker host" can mean something totally different than the OP title)
  - kaashif 2y ago
    What is the other meaning of "Root your docker host" which is disambiguated by adding "for fun and profit"?
    - edward28 2y ago
      If you say it with an Aussie accent.
    - orwin 2y ago
      I guess "Enable root on your docker host" was my idea (i'm still a VM guy, i don't know if it make sense on docker, but you never know)
- phrotoma 2y ago
  Arcane wisdom. A friend gave me this printed on tractor paper in the 90's and blew my tiny mind.

eternauta3k 2y ago

If there's basically no security, it would be more honest to do away with the "docker" group and just say that you need to give root to all docker users.

woodrowbarlow 2y ago
this is why, when you install docker, it doesn't add any users to the group automatically. it's an extra "post-installation step" listed in the documentation, with a big warning flag explaining that this is effectively equivalent to handing out root. https://docs.docker.com/engine/install/linux-postinstall/ https://docs.docker.com/engine/install/linux-postinstall/
slayerjain 2y ago
I think this is the reason docker on linux requires appending sudo to the command by default. Creating a docker group and adding the user to the docker group to avoid sudo is more of a convenience thing, and the implication seems to be well documented now - https://docs.docker.com/engine/install/linux-postinstall/ https://docs.docker.com/engine/install/linux-postinstall/ so if someone sacrificed convenience over security, I think the authors can't do much. Also I think there's no such thing as secure vs non-secure product, instead its levels of security.
- slayerjain 2y ago
  Thanks to who ever upvoted my comment. Someone had downvoted me (╥﹏╥)
dathinab 2y ago
It is for me also still a irritating wonder why most Linux distros ship docker like they do (which often doesn't include the docker group but sets it up in a way where it's likely users end up using it, and security warnings related to it are often more then lacking). I mean they could ship rootless docker by default, like podman defaults to rootless (or other by now possible more secure non default setups). Also if you care you probably want to combine rootless (or non-rootless but still user namespace using) docker with a linux secure module setup like SELinux, as it can make security vulnerabilities in rootless docker (and well docker in general) much harder to exploit.

xyst 2y ago

Likely the reason why “rootless mode” docker exists https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/ Noteworthy alternate: podman

pella 2y ago
https://podman.io/ https://podman.io/ "Rootless containers allow you to contain privileges without compromising functionality."
- vdfs 2y ago
  Also Podman doesn't require a daemon
  - stingraycharles 2y ago
    This is the biggest part imho. Podman just inherits the permissions of the current user, which makes things so much easier to reason about from a security perspective.

raesene9 2y ago

For an even earlier reference (2015) "the most pointless docker command ever" https://zwischenzugs.com/2015/06/24/the-most-pointless-docker-command-ever/ https://zwischenzugs.com/2015/06/24/the-most-pointless-docke... This is a by design part of Docker's operation. What's perhaps a little more surprising (though it shouldn't be) is that anyone with create pod rights in a k8s cluster can do this by default on every worker node in the cluster. (unless the cluster operator or provider has implemented additional controls)

f0e4c2f7 2y ago

Does this still work?

slayerjain 2y ago
Not by default. But if a docker group is created and the non root user is intentionally added to docker group despite ignoring the warnings in red here - https://docs.docker.com/engine/install/linux-postinstall https://docs.docker.com/engine/install/linux-postinstall then yes :)

deleted 2y ago

[deleted]

sunshine-o 2y ago

My pet theory is that open source is very much about packaging things. I remember being amazed when I discovered that there was this a system, called GNU/Linux, where everything you need was already packaged and easy to install. Then came the Maven, npm & co. Docker (and containers) is basically an universal package manager that was fulled by the success of open source, the arrival of a lot of new people (working on Mac and Windows) in that space and the adoption of the cloud. Docker Hub became the open source "app store". The crime is the misleading term "container" because I bet a majority of people assume there is some security guarantee by design, what is absolutely false. Actually container security is pretty hard and a most people don't really care because it doesn't run on their computer but in the cloud. My guess is something like Kata containers, compatible with the container standards while leveraging hardware virtualization technology will prevail. Or a cleaner system, similar to NixOS/Guix but easier to use, will appear.

Gasp0de 2y ago

I don't get why this is supposed to be a big thing, I thought it was commonly known. This doesn't mean that people can get root from inside a docker container, just that anyone who is allowed to create and start docker containers on a machine can also get root on that machine.

znpy 2y ago

This article is from 2017. Rootless docker is still not the default choice somehow. Podman however has been working rootlessly for a few years now, and does not suffer from many of the docker shortcomings.

HankB99 2y ago
> and does not suffer from many of the docker shortcomings. Would you care to elaborate on the shortcomings? I use Docker in my home lab and have taken a couple runs at Podman but have not been highly motivated and reverted to Docker rather than fiddle with things to get my containers working. If I were aware of significant benefits for my usage, I might be inclined to keep trying. If the benefits are more relevant to enterprise or cloud environs, it probably does not matter much to me. My use cases include Gitea (git server) which opens privileged ports inside the container that get mapped to unprivileged ports on the host and I believe that was a problem area. Thanks!
- worksonmine 2y ago
  > opens privileged ports inside the container that get mapped to unprivileged ports on the host You can either allow those ports to be mapped on your host, or you can map a higher port on the host 8000:80 or 4443:443. I did the former. The biggest problem I have with docker other than root is that it touches the firewall for convenience. Any port you map on the host will be opened in nftables, as per the documentation[1]. Very dangerous default that few developers realize is a problem. You probably only want 80/443 open and proxy your subdomains on the host, but all ports are now exposed to the internet. [1]: https://docs.docker.com/network/#published-ports https://docs.docker.com/network/#published-ports
  - HankB99 2y ago
    > Any port you map on the host will be opened in nftables ... That rates a "Wow!" but seems like something more important to Enterprise/Cloud. It seems like it would be a Bad Thing to open a port because a DB server ran in a different container. That's not something that should be opened unless the DB is on a different host (VM) from an application that uses the DB. In my case I have a firewall/router protecting my home LAN and don't generally run firewalls on individual hosts.