Docker Bug Allows Root Access to Host Filesystem • Hacker News Board

Re: Docker Bug Allows Root Access to Host Filesystem

#11

Post by dobin » Wed, May 29, 2019, 2:03 PM UTC

arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

In my opinion, VM's are less secure than containers.

VM's provide a large attack surface, while one CAN restrict containers sufficiently. See contained.af. Doesnt mean Docker does this though.

Re: Docker Bug Allows Root Access to Host Filesystem

#12

Post by tty7 » Wed, May 29, 2019, 2:09 PM UTC

baq wrote: post #9

pmlnr wrote: post #4

Earlier quoted context omitted.

I wanted to write the same; docker is a packaging solution. It's not a security layer.

i feel like this is oversimplifying, otherwise we'd be happily running tarballs in chroots. (jails anyone?)

huh, what do you chroot to apt-get/dnf ?

Re: Docker Bug Allows Root Access to Host Filesystem

#13

Post by cyphar » Wed, May 29, 2019, 2:09 PM UTC

https://news.ycombinator.com/item?id=20031403 was the discussion from yesterday to the oss-security post.

Re: Docker Bug Allows Root Access to Host Filesystem

#14

Post by tapoxi » Wed, May 29, 2019, 2:14 PM UTC

arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

An excellent talk from Red Hat's Dan Walsh: https://www.youtube.com/watch?v=a9lE9Urr6AQ

Re: Docker Bug Allows Root Access to Host Filesystem

#15

Post by mitchell_h » Wed, May 29, 2019, 2:15 PM UTC

arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

https://www.youtube.com/watch?v=hgN8pCMLI2U

Bryan expresses his opinions on this. When you say Isolate that really should include security.

Re: Docker Bug Allows Root Access to Host Filesystem

#16

Post by cyphar » Wed, May 29, 2019, 2:20 PM UTC

arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

If you take a look at LXC and LXD, I would very much argue you can use them as a security boundary. One of the main problems with Docker is that the most powerful isolation primitive available in Linux -- user namespaces -- is not used by default and doesn't fully utilise the underlying feature. LXC uses unprivileged user namespaces by default, and LXD defaults to user namespaces as well. You can even isolate containers from each other with a basic config option.

All of that being said, this bug is caused by container runtimes trusting the rootfs too much. This is something I've been trying to improve but it's definitely not a trivial problem (lots of things require trusting the container processes in specific ways due to limitations in the corresponding kernel APIs -- though I am working on fixing those too).

Re: Docker Bug Allows Root Access to Host Filesystem

#17

Post by Tepix » Wed, May 29, 2019, 2:21 PM UTC

arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

Containers' raison d'être is to provide isolation. Just like chroot, they are used for security. If the security mechanism fails, it's good to have defense-in-depth, as usual.

From reading the article it appears the issue is in Docker, not the container mechanism offered by the kernel upon which Docker builds.

Re: Docker Bug Allows Root Access to Host Filesystem

#18

Post by asveikau » Wed, May 29, 2019, 2:22 PM UTC

mitchell_h wrote: post #15

arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

https://www.youtube.com/watch?v=hgN8pCMLI2U Bryan expresses his opinions on this. When you say Isolate that really should include security.

The Unix process, with its uids, is also a form of isolation. But most reasonable people would guess that there are undiscovered privilege escalation bugs in any given kernel and thus be careful who is allowed to put code on a machine.

Re: Docker Bug Allows Root Access to Host Filesystem

#19

Post by laumars » Wed, May 29, 2019, 2:23 PM UTC

arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

Is that an unpopular opinion? I don't think I see many people who do argue about docker from a security standpoint. At least nobody credible.

Docker has always been sold as more of an development and orchestration tool than a security one.

Re: Docker Bug Allows Root Access to Host Filesystem

#20

Post by fwsgonzo » Wed, May 29, 2019, 2:23 PM UTC

dobin wrote: post #11

arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

In my opinion, VM's are less secure than containers. VM's provide a large attack surface, while one CAN restrict containers sufficiently. See contained.af. Doesnt mean Docker does this though.

I'm sorry but that is just false. VMs provide strong isolation which can even be two-way with secure enclaves.