4 ms·
Also user namespaces have had a long list of vulnerabilities, but that's still better than running docker as root directly.
by LtWorf 1y ago
Also user namespaces have had a long list of vulnerabilities, but that's still better than running docker as root directly.
- jeffbee 1y agoHrmm. "Take over the entire machine" type vulnerabilities, or "these namespaces weren't quite as isolated as we thought" vulnerabilities?
- LtWorf 1y agoCVEs are publicly available
- cpuguy83 1y agoEscalating from an unprivileged user to root by creating userns and exploiting various things in the kernel along the way.
- chupasaurus 1y agoThe latter can easily propagate to the former if seccomp/AppArmor/MAC isn't set properly.
- cpuguy83 1y agoThat is a ridiculous statement. In the case of userns exploits there have been many and it means that every unprivileged user can obtain root on the machine. Whereas rootful docker is a well known thing, run on millions of machines, and none of the vulnerabilities discovered in its entire existence is as bad as any single priv escalation issue caused by allowing unprivileged users to create a user namespace.