3 ms·
Not sure how secure this really is, because it's fairly easy to break out of a Docker container with the default settings (due to the fact that the kernel is sh
by a022311 1y ago
Not sure how secure this really is, because it's fairly easy to break out of a Docker container with the default settings (due to the fact that the kernel is shared between containers and the host, unlike with VMs). Rootless Docker (or better, Podman) would improve security greatly.
- ashishb 1y agoCan you show an example of how can a malicious package break out of docker?
- a022311 1y agoThere have been quite a few exploits over the years, with the most recent public CVE 2 years ago [1]. Your specific setup uses `--net=host` and this opens you up to potential vulnerabilities (see [2]). You also shouldn't forget that containers have unrestricted network access bu default anyway. Even if your device is safe, they may be able to infect other vulnerable devices on your network. [1]: https://docs.docker.com/security/security-announcements/#docker-security-advisory-multiple-vulnerabilities-in-runc-buildkit-and-moby https://docs.docker.com/security/security-announcements/#doc... [2]: https://github.com/0xn3va/cheat-sheets/blob/main/Container/Escaping/host-networking-driver.md https://github.com/0xn3va/cheat-sheets/blob/main/Container/E...
- TacticalCoder 1y ago[dead]