4 ms·
This is very good, but should have been submitted as a link directly to your site. > each site sits in its own container, so if it is compromised, no harm come
by finid 11y ago
This is very good, but should have been submitted as a link directly to your site.
> each site sits in its own container, so if it is compromised, no harm comes to any other site or services running on the host system.
But what about the security shortcoming of running Docker containers? this does not seem to do anything to address it.
- x5n1 11y agoThe process serving the website, Nginx and PHP-FPM, does not run as root. It's no less secure than running a non-root user like www-data to serve your site. If you can breakout to root within the container, you can potentially get to the host system. But that's absolutely no different than any other Linux system. If you break out of www-data on a normal setup to root, then you have root. All that Docker is acting as is a chroot that's easier to deploy and configure with its own networking stack. There is one weakness that I will be addressing soon, which is that Dockergen is running within the same container as as the Nginx proxy, and that's a bit dangerous -- not that dangerous because there is no user defined code that executes in the proxy's container and no way to upload anything to that container... but if there were a weakness in Nginx that would allow users to upload code to the proxy container and execute that then it might be problematic. For this reason Dockegen will be moved to a separate container that is not interacting with the web.