4 ms·

Despite what some people will tell you (including many in the security indistry), Docker is not a strong security boundary, and it should not be treated as one.

Despite what some people will tell you (including many in the security indistry), Docker is not a strong security boundary, and it should not be treated as one. It shares a kernel with the running system. It reminds me of the good old days when people would hand out low privilege Linux accounts and rely on the kernel to prevent privilige escalation. Docker is literally the same thing, just with extra steps. Especially today with new kernel LPE'S dropping every 5 minutes. Yes, Podman is a bit better because you arent handing the attacker root, but... why hand them an account at all? Just use a grown up VM.

zenoprax 5mo ago
[dead]
beardedwizard 5mo ago
Yeah because I'd rather trade one kernel surface for another.
throw0101c 5mo ago
> Despite what some people will tell you (including many in the security indistry), Docker is not a strong security boundary, and it should not be treated as one. It shares a kernel with the running system. Solaris Zones and FreeBSD Jails (their inspiration) also share a kernel with the running system and do not seem to have as many escape vulnerabilities. (Though partly because there may not be as much scrutiny of course.)
- Icathian 5mo ago
  Yeah, I'm reminded of 15 years ago being told Linux was super secure because people were popping Windows all the time. Turns out it was mostly just a function of effort pointed at the target, and I don't have any reason to believe that's not the case here too.
  - ErroneousBosh 5mo ago
    Linux has had 100% market penetration for 20 years or so now. Everyone using a computer uses Linux *somewhere* in it. You'd think if it was that easy, there would be exploits all over the place. Why isn't every single desk phone and router part of a botnet?
    - pyinstallwoes 5mo ago
      I mean? Many of them are…
    - Icathian 5mo ago
      Kimwoolf and Aisuru kind of make my point better than yours, I think?
pezgrande 5mo ago
Only works if the Docker socket is mounted which is pretty stupid thing to do and also not something you would do in a "frontend" container. Essentially is like having a password-less ssh
MattCruikshank 5mo ago
I've been toying with using Jart's Blink, the "tiniest x86-64-linux emulator". If it were hardened against attacks by a smart community, it seems really attractive... Then I've been toying with using WASM, with a strictly limited API surface... (API stands for what, "Attack, Please, Infiltrators"?) I'd really love to make a service which can run "untrusted" code... I want this to exist. I want it to feel like the Sandstorm.io marketplace, and to use Tailscale or something like it... and then to make "Facebook but only for friends or friends-of-friends." No public figures. No random people or ads in my feeds. Just friends. And then other similar apps - mail, discord, etc. Don't let it make outbound HTTP connections. Don't let it access local filesystem, other than assets that were bundled with it. Give it a SQLite API... And let it handle inbound HTTP, REST, WebSocket requests... And use gRPC over Tailscale to only talk directly to approved contacts... Thoughts? How to run untrusted code safely? I tried using Firecracker and gVisor... But I'm dissatisfied with them. I was trying to make it easy for someone to download and run my service... But Firecracker and gVisor don't at all feel like "libraries that install cleanly." They feel more like, if you're enterprise scale, you can hire someone to make sure Firecracker and gVisor work the way you want... Maybe I'm just not trying hard enough... Maybe using WSL2 on Windows 11 is just asking for trouble. I tried several different ways to run Linux on Windows, and none of them seemed very happy, when I tried to add Firecracker / gVisor.
- corford 5mo ago
  We've been leaning on Lima recently for a "dockeresque" experience with hard VM guarantees. Also keeping an eye on https://github.com/containers/crun/blob/main/krun.1.md https://github.com/containers/crun/blob/main/krun.1.md
zahlman 5mo ago
> the good old days when people would hand out low privilege Linux accounts and rely on the kernel to prevent privilige escalation. ... Did that actually stop? ... Is that not the purpose of being able to make multiple accounts (even on a random desktop or laptop system) and restrict their privileges?
staticassertion 5mo ago
Docker is a lot more than just an unprivileged user. In particular, it comes with a seccomp filter. A lot of LPEs are blocked by that filter. Docker is actually a quite decent security boundary - in this case the attackers did not attempt to subvert docker by attacking the kernel attack surface, they attacked a weak configuration via the docker socket being mounted. The reason you don't use a "grown up VM" is because it's significantly more difficult. Which VM? Firecracker requires KVM and a guest operating system - so how are you getting things in and out in a way that doesn't violate security? That's real work. gVisor is great and my recommendation, certainly, but the difference between "nothing" and "docker" is actually pretty huge imo.
- mapontosevenths 5mo ago
  > the difference between "nothing" and "docker" is actually pretty huge You've got me there, but it's not really saying much. Seccomp, for example, is nice, but... It blocks ~44 system calls, and leaves 300 plus exposed. Any memory corruption issue in those remaining calls remain wide open. So better than nothing? Absolutely, but it leads to a false sense of security. I know actual security researchers that intentionally run malware inside Docker and think they're safe. They're not. Then we can talk about docker itself. It had something like 6 public CVE's related to full escapes last year. If your patch cycle takes 30 days then you spend about half the year with a full, public, escape known. Even if you patched those all on day one you spent most of the year vulnerable to one of the many Kernel vulns that it doesn't stop. On any given calendar day it's statistically likely there is at LEAST one way to escape publicly known and unpatched. So, yeah. It beats nothing by a huge margin, but it's WORSE than nothing if you think it's safe to run arbitrary untrusted code in. That was never what it was for, it's just what people treat it as. It's not a VM, wasn't designed to be, and people need to stop pretending it is.

zenoprax 5mo ago

[dead]

beardedwizard 5mo ago

Yeah because I'd rather trade one kernel surface for another.

throw0101c 5mo ago

> Despite what some people will tell you (including many in the security indistry), Docker is not a strong security boundary, and it should not be treated as one. It shares a kernel with the running system. Solaris Zones and FreeBSD Jails (their inspiration) also share a kernel with the running system and do not seem to have as many escape vulnerabilities. (Though partly because there may not be as much scrutiny of course.)

Icathian 5mo ago
Yeah, I'm reminded of 15 years ago being told Linux was super secure because people were popping Windows all the time. Turns out it was mostly just a function of effort pointed at the target, and I don't have any reason to believe that's not the case here too.
- ErroneousBosh 5mo ago
  Linux has had 100% market penetration for 20 years or so now. Everyone using a computer uses Linux *somewhere* in it. You'd think if it was that easy, there would be exploits all over the place. Why isn't every single desk phone and router part of a botnet?
  - pyinstallwoes 5mo ago
    I mean? Many of them are…
  - Icathian 5mo ago
    Kimwoolf and Aisuru kind of make my point better than yours, I think?

pezgrande 5mo ago

Only works if the Docker socket is mounted which is pretty stupid thing to do and also not something you would do in a "frontend" container. Essentially is like having a password-less ssh

MattCruikshank 5mo ago

I've been toying with using Jart's Blink, the "tiniest x86-64-linux emulator". If it were hardened against attacks by a smart community, it seems really attractive... Then I've been toying with using WASM, with a strictly limited API surface... (API stands for what, "Attack, Please, Infiltrators"?) I'd really love to make a service which can run "untrusted" code... I want this to exist. I want it to feel like the Sandstorm.io marketplace, and to use Tailscale or something like it... and then to make "Facebook but only for friends or friends-of-friends." No public figures. No random people or ads in my feeds. Just friends. And then other similar apps - mail, discord, etc. Don't let it make outbound HTTP connections. Don't let it access local filesystem, other than assets that were bundled with it. Give it a SQLite API... And let it handle inbound HTTP, REST, WebSocket requests... And use gRPC over Tailscale to only talk directly to approved contacts... Thoughts? How to run untrusted code safely? I tried using Firecracker and gVisor... But I'm dissatisfied with them. I was trying to make it easy for someone to download and run my service... But Firecracker and gVisor don't at all feel like "libraries that install cleanly." They feel more like, if you're enterprise scale, you can hire someone to make sure Firecracker and gVisor work the way you want... Maybe I'm just not trying hard enough... Maybe using WSL2 on Windows 11 is just asking for trouble. I tried several different ways to run Linux on Windows, and none of them seemed very happy, when I tried to add Firecracker / gVisor.

corford 5mo ago
We've been leaning on Lima recently for a "dockeresque" experience with hard VM guarantees. Also keeping an eye on https://github.com/containers/crun/blob/main/krun.1.md https://github.com/containers/crun/blob/main/krun.1.md

zahlman 5mo ago

> the good old days when people would hand out low privilege Linux accounts and rely on the kernel to prevent privilige escalation. ... Did that actually stop? ... Is that not the purpose of being able to make multiple accounts (even on a random desktop or laptop system) and restrict their privileges?

staticassertion 5mo ago

Docker is a lot more than just an unprivileged user. In particular, it comes with a seccomp filter. A lot of LPEs are blocked by that filter. Docker is actually a quite decent security boundary - in this case the attackers did not attempt to subvert docker by attacking the kernel attack surface, they attacked a weak configuration via the docker socket being mounted. The reason you don't use a "grown up VM" is because it's significantly more difficult. Which VM? Firecracker requires KVM and a guest operating system - so how are you getting things in and out in a way that doesn't violate security? That's real work. gVisor is great and my recommendation, certainly, but the difference between "nothing" and "docker" is actually pretty huge imo.

mapontosevenths 5mo ago
> the difference between "nothing" and "docker" is actually pretty huge You've got me there, but it's not really saying much. Seccomp, for example, is nice, but... It blocks ~44 system calls, and leaves 300 plus exposed. Any memory corruption issue in those remaining calls remain wide open. So better than nothing? Absolutely, but it leads to a false sense of security. I know actual security researchers that intentionally run malware inside Docker and think they're safe. They're not. Then we can talk about docker itself. It had something like 6 public CVE's related to full escapes last year. If your patch cycle takes 30 days then you spend about half the year with a full, public, escape known. Even if you patched those all on day one you spent most of the year vulnerable to one of the many Kernel vulns that it doesn't stop. On any given calendar day it's statistically likely there is at LEAST one way to escape publicly known and unpatched. So, yeah. It beats nothing by a huge margin, but it's WORSE than nothing if you think it's safe to run arbitrary untrusted code in. That was never what it was for, it's just what people treat it as. It's not a VM, wasn't designed to be, and people need to stop pretending it is.