Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alpine Linux Docker images have NULL for root password

cve.mitre.org

Post reply on HN
Print view View original

161–170 of 203 posts

Re: Alpine Linux Docker images have NULL for root password

#161

Post by svacko »

Jonanin wrote: post #22
yegle wrote: post #19

Earlier quoted context omitted.

For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless is a good choice, especially if you are writing in static linked language e.g. Go and Rust.

For Python I'd also highly recommend Clear Linux for raw performance. It's not quite as easy to get started as with something like Ubuntu though.

Clear Linux is definitely an interesting project, however, using base image with 'latest' tag (only tag existing for https://hub.docker.com/r/clearlinux/python/tags) in the production is not a best strategy as the breaking changes can arrive anytime

Re: Alpine Linux Docker images have NULL for root password

#162

Post by zaarn »

code_duck wrote: post #123
akvadrako wrote: post #6

Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $

On every distro in the past, i’d do sudo passwd. Always worked. No idea about Alpine.

Alpine comes with no suid binaries in Docker to my knowledge (it's expected you run your stuff as root inside the container unless there is a reason not to)

Re: Alpine Linux Docker images have NULL for root password

#163

Post by disiplus »

smolder wrote: post #125
disiplus wrote: post #105

Earlier quoted context omitted.

but without tls amazon can "decrypt" your traffic and see whats inside. its one thing to have a backdoor inside a server that they rent to you that would have to be actively exploited and another to passively clone the traffic and analyze it in the name of making the service better.

Why do they have to actively exploit hardware/vms that they own? Isn't it pretty trivial for a hypervisor to "passively clone" data right out of the memory of the VM? Or to use management interfaces/custom peripherals to exfiltrate data if it were bare metal? AWS is kind of a black box to me but it seems hopeless to try to protect data from people that physically control the systems.

i was especially talking about passively mirroring/analysing network traffic. afak there is no easy and trivial way to "passively clone" aka dump memory of the hypervisor all the time without it being detectable in slowdowns and so on. my concern was not that i need to protect myself from amazon for the fear that they will hack my server, but to the way that they can get insight into my customers, maybe get a snippet of the data i get and so on.

we once saw this from some other company where they noticed we where talking to the competitors and wanted to talk.

Re: Alpine Linux Docker images have NULL for root password

#164

Post by dnautics »

hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

It's not just a few megabytes, it's more like hundreds. If you're moving an image across a bad network (like the internet) that could be hundreds of milliseconds.

Re: Alpine Linux Docker images have NULL for root password

#165

Post by geezerjay »

dnautics wrote: post #164
hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

It's not just a few megabytes, it's more like hundreds. If you're moving an image across a bad network (like the internet) that could be hundreds of milliseconds.

I would also add that data transfers cost money, and having to transfer a few hundred MBs each time a container image is passed around can reflect in the expenses.

Re: Alpine Linux Docker images have NULL for root password

#166

Post by geezerjay »

yegle wrote: post #37
catern wrote: post #32

Earlier quoted context omitted.

"distroless" is just Debian packages. Their self-description is fairly annoyingly misleading, since they don't mention that they are just using packages from Debian.

Why is that a bad thing? Binaries are binaries, whether you copied from a deb package or completely built from source code (assuming reproducible build, which Debian supports), they are the same.

> Binaries are binaries, whether you copied from a deb package or completely built from source code

No, they are not.

Debian packages are deployable packages, which are built around packages and services and conventions adopted and provided by the target distribution.

Re: Alpine Linux Docker images have NULL for root password

#167

Post by GordonS »

sprydevl wrote: post #153
yegle wrote: post #19

Earlier quoted context omitted.

For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless is a good choice, especially if you are writing in static linked language e.g. Go and Rust.

If you want small images, why not use a tool like https://github.com/docker-slim/docker-slim Then it doesn’t matter which distro you favor?

Wow, I've never heard of this before - I'm looking forward to seeing how much this shrinks my images!

Re: Alpine Linux Docker images have NULL for root password

#169

Post by arghwhat »

zaarn wrote: post #162
code_duck wrote: post #123

Earlier quoted context omitted.

On every distro in the past, i’d do sudo passwd. Always worked. No idea about Alpine.

Alpine comes with no suid binaries in Docker to my knowledge (it's expected you run your stuff as root inside the container unless there is a reason not to)

Just for the uninitiated:

suid binaries are binaries with a special flag set that will make it run with root privileges regardless of who started it.

sudo is an example of something that would use suid. When a user runs sudo, the binary actually runs with root privileges from the get-go, checks if the user is OK, then executes the command you specified.

However, use of sudo or other suid binaries is entirely pointless in an alpine container. There being no password also does not matter, as you are by default already running everything as root. Who cares if root can become root?

Re: Alpine Linux Docker images have NULL for root password

#170

Post by johnisgood »

akvadrako wrote: post #6

Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $

Docker is a risk "out of the box". It requires root to run the daemon, and to use it you either need sudo or belong to the docker group which is equivalent to root access.

On their website they claim docker is "quite secure" if you "run your processes as non-privileged users inside the container", but I do not see how this would be the case given that breakouts happen all the time, AND again, it requires root to run, which gives me the opposite vibe of secure.

Docker is for convenience and it is a security risk.

Post reply on HN