Docker Bug Allows Root Access to Host Filesystem
1–10 of 60 posts
Re: Docker Bug Allows Root Access to Host Filesystem
#2This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security.
It should be used to ease deployment.
Re: Docker Bug Allows Root Access to Host Filesystem
#3This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.
Does your recommendation still stand when Docker used in conjunction with SELinux (and SELinux categories for tennancy isolation)?
Re: Docker Bug Allows Root Access to Host Filesystem
#4This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.
I wanted to write the same; docker is a packaging solution. It's not a security layer.
Re: Docker Bug Allows Root Access to Host Filesystem
#5So, it can be exploited having access to the machine where docker is running and then using docker cp?
can someone make a real use case of this bug?
Re: Docker Bug Allows Root Access to Host Filesystem
#6This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.
Does your recommendation still stand when Docker used in conjunction with SELinux (and SELinux categories for tennancy isolation)?
That seems like lazy contrarianism.
If you put docker inside a VM, and your hypervisor is running in a zone, and you have different zones based on ”role”. Then of course you get the benefits of the zone and the hypervisor.
The parent said “docker solves deployment, not isolation”- if you get your isolation another way then there’s no issue with using docker.
Re: Docker Bug Allows Root Access to Host Filesystem
#7This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.
Containerization certainly ought to be an isolation layer to boost security. What's unfortunate is how little we can rely on docker to provide any additional security.
Re: Docker Bug Allows Root Access to Host Filesystem
#8So, it can be exploited having access to the machine where docker is running and then using docker cp? can someone make a real use case of this bug?
The suggestion in the linked post is a situation where the Docker daemon is being controlled via its API in a multi-tennant environment where user configuration files are loaded into the container via the cp endpoint. I could concieve of this being a risk if you allow users to create symlinks in the location where the configuration files are situated.
Re: Docker Bug Allows Root Access to Host Filesystem
#9This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.
I wanted to write the same; docker is a packaging solution. It's not a security layer.
i feel like this is oversimplifying, otherwise we'd be happily running tarballs in chroots. (jails anyone?)
Re: Docker Bug Allows Root Access to Host Filesystem
#10Earlier quoted context omitted.
Does your recommendation still stand when Docker used in conjunction with SELinux (and SELinux categories for tennancy isolation)?
That seems like lazy contrarianism. If you put docker inside a VM, and your hypervisor is running in a zone, and you have different zones based on ”role”. Then of course you get the benefits of the zone and the hypervisor. The parent said “docker solves deployment, not isolation”- if you get your isolation another way then there’s no issue with using docker.
Fair enough. :)
Docker does have fairly good support for SELinux built in tho (which counts as "using Docker" in my book).
And I do like that Docker makes the SELinux fairly straight forward for the simplest usecases (adding :z or :Z to volume directives).