Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AinD: Android in Docker

github.com

Post reply on HN
Print view View original

21–26 of 26 posts

Re: AinD: Android in Docker

#21

Post by rtempaccount1 »

mister_hn wrote: post #8
ryanmjacobs wrote: post #2

I really want to try this, but I'm a little hesitant with the --privileged flag. Sounds like this is pretty much giving root access to the container? ( https://stackoverflow.com/questions/36425230/privileged-cont... ) Could someone (or OP) enlighten me on what requires this flag? I thought the container would also get access to the anbox kernel modules that I have installed already.

But docker runs still with root privileges (or your user must be in the docker group, which is equivalent to root - so is also in the official documentation explained)

The user who runs the docker command can indeed always get root (with a default install, assuming you're not using rootless) but the process inside the container isn't going to necessarily breakout.

That's why --privileged is generally a bad idea, unless you really need it, as it removes the isolation that Docker adds.

Re: AinD: Android in Docker

#22

Post by containrh4x0r »

ryanmjacobs wrote: post #12
mister_hn wrote: post #8

Earlier quoted context omitted.

But docker runs still with root privileges (or your user must be in the docker group, which is equivalent to root - so is also in the official documentation explained)

Right I get that, it's because the docker daemon needs root access to do its management stuff. But as far as running random "bad things" off docker hub, I always assume it's going to be fenced off. Like by default, the containers cannot read external files or open up host ports, etc. But with --privileged I guess it can do anything. I'm a big fan of people supplying pre-built docker images because it lets me try out…

repeat after me - "there are no isolation boundaries with containers" "containers are insecure"

Containers are broken by default because they share a kernel. If you want to use a container to have a replicable build environment fine - but for operational use in the context of "being secure" - no no no no.

Re: AinD: Android in Docker

#23

Post by fulafel »

londons_explore wrote: post #15
ryanmjacobs wrote: post #12

Earlier quoted context omitted.

Right I get that, it's because the docker daemon needs root access to do its management stuff. But as far as running random "bad things" off docker hub, I always assume it's going to be fenced off. Like by default, the containers cannot read external files or open up host ports, etc. But with --privileged I guess it can do anything. I'm a big fan of people supplying pre-built docker images because it lets me try out…

I think you're putting too much faith in the security of docker... It is only superficially secure, and any real evil software can break out of it since the attack surface is huuuge (every loaded kernel driver).

It's telling that user namespaces (remapping uid 0 to another hodt uid) aren't used by default.

Re: AinD: Android in Docker

#24

Post by AkihiroSuda »

aioprisan wrote: post #16
mister_hn wrote: post #8

Earlier quoted context omitted.

But docker runs still with root privileges (or your user must be in the docker group, which is equivalent to root - so is also in the official documentation explained)

Not necessary anymore, you just need to enable overlayfs for unprivileged users https://kernel.ubuntu.com/git/ubuntu/ubuntu-bionic.git/commi...

overlayfs isn't necessary either :)

Re: AinD: Android in Docker

#25

Post by AkihiroSuda »

packetlost wrote: post #18
severine wrote: post #14

Earlier quoted context omitted.

Maybe: Someone steals your smartphone now -> they've got everything , and a smartphone vs Someone steals your clouded smartphone -> they've got an empty smartphone and no data.

This is a very, very, very bad idea. Just encrypt your phone with a strong passcode and backup regularly. Making your phone entirely dependent on a strong internet connection is a recipe for a bad time.

I agree that the phone should be encrypted (in conjunction with aind), but people are likely to set weak passcode like "1234" (or finger pattern) because they want to open email/phone/twitter/maps/payment apps in a few seconds.

aind is expected to be used only for sensitive apps, with more strong passcode.

Re: AinD: Android in Docker

#26

Post by AkihiroSuda »

woodrowbarlow wrote: post #19
severine wrote: post #14

Earlier quoted context omitted.

Maybe: Someone steals your smartphone now -> they've got everything , and a smartphone vs Someone steals your clouded smartphone -> they've got an empty smartphone and no data.

a hardware phone whose OS is running in the cloud? that sounds pretty bandwidth-heavy on the LTE network.

Look forward to 5G :)
Post reply on HN