11–20 of 26 posts
What's the advantage compared to just using Anbox?
The biggest advantage of running Android on cloud/edge I think is anti-theft.
Also, it will be soon able to run multiple aind pods on Kubernetes with distinct UID mappings. (I need to submit patches to Anbox upstream)
I really want to try this, but I'm a little hesitant with the --privileged flag. Sounds like this is pretty much giving root access to the container? ( https://stackoverflow.com/questions/36425230/privileged-cont... ) Could someone (or OP) enlighten me on what requires this flag? I thought the container would also get access to the anbox kernel modules that I have installed already.
But docker runs still with root privileges (or your user must be in the docker group, which is equivalent to root - so is also in the official documentation explained)
I'm a big fan of people supplying pre-built docker images because it lets me try out their software in what I assume to be a sandbox. I'm a little less wary when it comes to docker -- almost to the point of being nonchalant, running random images willy-nilly without digging into the source code even a tiny bit. Granted, that behavior is probably gonna bite me in the ass one day. But it's definitely better than the `curl http://example.com | bash -` and `sudo make install` patterns.
Whenever I see someone's instructions telling me to use `docker --network=host` or `docker --privileged`, I can't help but panic a little... "Am I going to regret running this developer's code as root on my machine?" A little justification from the OP eases my mind, that's all. Which he did :)
What's the advantage compared to just using Anbox?
Anbox is for desktop, aind is for cloud (and edge). The biggest advantage of running Android on cloud/edge I think is anti-theft. Also, it will be soon able to run multiple aind pods on Kubernetes with distinct UID mappings. (I need to submit patches to Anbox upstream)
what is this anti-theft? What's being stolen?
Earlier quoted context omitted.
Anbox is for desktop, aind is for cloud (and edge). The biggest advantage of running Android on cloud/edge I think is anti-theft. Also, it will be soon able to run multiple aind pods on Kubernetes with distinct UID mappings. (I need to submit patches to Anbox upstream)
> The biggest advantage of running Android on cloud/edge I think is anti-theft. what is this anti-theft? What's being stolen?
Someone steals your smartphone now -> they've got everything , and a smartphone
vs
Someone steals your clouded smartphone -> they've got an empty smartphone and no data.
Earlier quoted context omitted.
But docker runs still with root privileges (or your user must be in the docker group, which is equivalent to root - so is also in the official documentation explained)
Right I get that, it's because the docker daemon needs root access to do its management stuff. But as far as running random "bad things" off docker hub, I always assume it's going to be fenced off. Like by default, the containers cannot read external files or open up host ports, etc. But with --privileged I guess it can do anything. I'm a big fan of people supplying pre-built docker images because it lets me try out…
I really want to try this, but I'm a little hesitant with the --privileged flag. Sounds like this is pretty much giving root access to the container? ( https://stackoverflow.com/questions/36425230/privileged-cont... ) Could someone (or OP) enlighten me on what requires this flag? I thought the container would also get access to the anbox kernel modules that I have installed already.
But docker runs still with root privileges (or your user must be in the docker group, which is equivalent to root - so is also in the official documentation explained)
Earlier quoted context omitted.
> The biggest advantage of running Android on cloud/edge I think is anti-theft. what is this anti-theft? What's being stolen?
Maybe: Someone steals your smartphone now -> they've got everything , and a smartphone vs Someone steals your clouded smartphone -> they've got an empty smartphone and no data.
Earlier quoted context omitted.
> The biggest advantage of running Android on cloud/edge I think is anti-theft. what is this anti-theft? What's being stolen?
Maybe: Someone steals your smartphone now -> they've got everything , and a smartphone vs Someone steals your clouded smartphone -> they've got an empty smartphone and no data.
Earlier quoted context omitted.
> The biggest advantage of running Android on cloud/edge I think is anti-theft. what is this anti-theft? What's being stolen?
Maybe: Someone steals your smartphone now -> they've got everything , and a smartphone vs Someone steals your clouded smartphone -> they've got an empty smartphone and no data.
Earlier quoted context omitted.
Right I get that, it's because the docker daemon needs root access to do its management stuff. But as far as running random "bad things" off docker hub, I always assume it's going to be fenced off. Like by default, the containers cannot read external files or open up host ports, etc. But with --privileged I guess it can do anything. I'm a big fan of people supplying pre-built docker images because it lets me try out…
I think you're putting too much faith in the security of docker... It is only superficially secure, and any real evil software can break out of it since the attack surface is huuuge (every loaded kernel driver).
I wouldn't agree that it's trivially possible to breakout of a default configured Docker container, not every attacker is packing a Linux Privesc 0-day and the knowledge to use it.