3 ms·

I don't really get all the docker hate/fear as-of-late. If you're a developer using docker, you should be reading the dockerfiles, reading any referenced shell

I don't really get all the docker hate/fear as-of-late. If you're a developer using docker, you should be reading the dockerfiles, reading any referenced shell scripts, and know what the command line arguments you're entering do. You should pretty much always be writing your own dockerfiles based on others adding your specific tweaks and then finally your software. That's what makes docker amazing: it lets you program your environment like an application. If you're carelessly running docker commands, dockerfiles, docker images, then you're going to expose yourself to the same security problems as if you were carelessly running shell scripts, binaries, or whatever else you don't look at the source and ensure will be safe and secure within your application's environment. The only thing I can see as a security concern specifically for docker users is the general swiftness of building your environment means developers might rush through it instead of taking the time to understand what is going on under the hood. But this is true of any software designed to ease something once arduous. I'm pretty new to docker myself so let me know if I am missing a gotcha somewhere. With that in mind, if you're properly mindful of your software, is there really any (hidden/unforeseen) danger in using the docker group? Certainly makes my life easier with zsh and the docker plugin.

chrisfosterelli 11y ago
The concern in this example isn't a malicious package, although that's something to be wary of. If your user account is compromised, an attacker now has root on your entire machine with no additional effort. This is why people are always saying to "not run as root". When you are a member of the Docker group, you're running as root. On your production servers, that's a significantly larger attack surface for a malicious party. To get full root, they just need to compromise a user account now. That's the unforseen danger, not the packages you download. Also, this isn't Docker hate. I use it every day and am quite fond of it, which is all the more reason to run it securely ;)

chrisfosterelli 11y ago

The concern in this example isn't a malicious package, although that's something to be wary of. If your user account is compromised, an attacker now has root on your entire machine with no additional effort. This is why people are always saying to "not run as root". When you are a member of the Docker group, you're running as root. On your production servers, that's a significantly larger attack surface for a malicious party. To get full root, they just need to compromise a user account now. That's the unforseen danger, not the packages you download. Also, this isn't Docker hate. I use it every day and am quite fond of it, which is all the more reason to run it securely ;)