Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex just found a "workaround" of not having sudo on my PC

twitter.com

Post reply on HN
Print view View original

11–20 of 330 posts

Re: Codex just found a "workaround" of not having sudo on my PC

#11

Post by Youden »

jjmarr wrote: post #7

Every time I try to install Docker there's a warning that being in the "docker" group is equivalent to having root access. You should probably know about this workaround by now.

I think that's distro-specific. Some set it up with more secure defaults (unix socket with permissions), others less (TCP socket).

Re: Codex just found a "workaround" of not having sudo on my PC

#12

Post by tempest_ »

unglaublich wrote: post #5
dangus wrote: post #3

Earlier quoted context omitted.

Right, why is their login user in the docker group? Mine sure isn’t.

Convenience. Want to run `docker run ...` without password, want IDEs and agents to be able to run containers...

For most CRUD apps running in docker its enough to just tell the "agent" to use podman.

Re: Codex just found a "workaround" of not having sudo on my PC

#13

Post by awoimbee »

unglaublich wrote: post #5
dangus wrote: post #3

Earlier quoted context omitted.

Right, why is their login user in the docker group? Mine sure isn’t.

Convenience. Want to run `docker run ...` without password, want IDEs and agents to be able to run containers...

Use podman then, or rootless docker if you can make it work

Re: Codex just found a "workaround" of not having sudo on my PC

#15

Post by throwaway613746 »

oytis wrote: post #6
dangus wrote: post #3

Earlier quoted context omitted.

Right, why is their login user in the docker group? Mine sure isn’t.

Rather, why do people still run agents as their own user. IMO, agent sessions should at least be containerised with just necessary code mounted.

People will more often than not, take the path of least resistance. Even if you tell them it's dangerous they will not care. People run this stuff on their primary workstation, unconfined, with permissions disabled because they don't want be bothered with accepting permission requests. This is all well and good until it decides to drop your production database or delete your home directory. Most of them don't even learn their lesson after that even.

Re: Codex just found a "workaround" of not having sudo on my PC

#17

Post by nialse »

This was of course dependent on yolo mode, but automatic approval has also been pulling stunts like this. A recent example is data that was purposely kept away from Codex in a folder far far away. When it found a single reference it just went for the data when having an issue. Lesson learned, keep essential data and Codex separated on different machines. Codex remote ssh actually helps here.

Re: Codex just found a "workaround" of not having sudo on my PC

#19

Post by ssl-3 »

oytis wrote: post #6
dangus wrote: post #3

Earlier quoted context omitted.

Right, why is their login user in the docker group? Mine sure isn’t.

Rather, why do people still run agents as their own user. IMO, agent sessions should at least be containerised with just necessary code mounted.

Safety and simplicity are concepts that often won't get along very well with eachother.

Re: Codex just found a "workaround" of not having sudo on my PC

#20

Post by cpuguy83 »

Youden wrote: post #11
jjmarr wrote: post #7

Every time I try to install Docker there's a warning that being in the "docker" group is equivalent to having root access. You should probably know about this workaround by now.

I think that's distro-specific. Some set it up with more secure defaults (unix socket with permissions), others less (TCP socket).

No, docker access means root. You can use "rootless" mode, in this case it means root in a user namespace (that is not the "host" user namespace).
Post reply on HN