3 ms·
Docker isn’t a sandbox and shouldn’t be treated like one. Admittedly if I’m going to run untrusted code I’ll run it in Docker, but I’m aware that whatever I’m r
by cedws 1y ago
Docker isn’t a sandbox and shouldn’t be treated like one. Admittedly if I’m going to run untrusted code I’ll run it in Docker, but I’m aware that whatever I’m running could break out. I wouldn’t blindly run some bullshit even in Docker unless I’m 90% sure it’s safe already.
- throwaway290 1y agoHow do you get to 90% sure for code that has any dependencies?
- OutOfHere 1y agoWhy is Docker (or extensions thereof) not a sandbox? Granted, it could access the internet, but that's necessary.
- cedws 1y agoDocker's primary purpose is to give applications their own namespaces in which they can run without conflict. It does confine applications to their own root filesystem, own process namespace and so on, but this isn't intended as a security boundary. cgroup escapes happen. Firecracker and gVisor provide much stronger isolation. Both are battle tested; clouds run millions of multi-tenant workloads on these every day. Docker would simply never even be a candidate for this purpose.
- integralid 1y ago>but I’m aware that whatever I’m running could break out If you have a working docker escape exploit at hand, that works on unprivileged containers, you can earn some good money. Just saying. Docker was not created as a sandbox, but people rely on it for security and it is a sandbox at this point. Hell, containerd is one of kuberbetes backends and it absolutely relies on it being a secure sandbox.