3 ms·
> Inside the sandbox but not on my machine. Show me how it can access an unmounted directory. So it says right on the tin of my favorite distro: 'Warning: Bewa
by sellmesoap 7mo ago
> Inside the sandbox but not on my machine. Show me how it can access an unmounted directory.
So it says right on the tin of my favorite distro:
'Warning: Beware that the docker group membership is effectively equivalent to being root!
Consider using rootless mode below.' So # docker run super-evil-oci-container with a bind mount or two and your would-be attacker doesn't need to guess your sudo password.
- imtringued 7mo agoWhat's particularly vexing is that there is this agentic sandboxing software called "container-use" and out of the box it requires you to add a user to the docker group because they haven't thought about what that really means and why running docker in that configuration option shouldn't be allowed, but instead they have made it mandatory as a default.
- ashishb 7mo ago> docker run super-evil-oci-container 1. That super evil OCI container still needs to find a vulnerability in Docker 2. You can run Docker in rootless mode e.g. Orbstack runs without root
- staticassertion 7mo agoThey're suggesting that the attacker is in a position to `docker run`. Any attacker in that position has privesc to root, trivially. Rootless mode requires unprivileged user namespaces, disabled on almost any distribution because it's a huge security hole in and of itself.