121–130 of 330 posts
Earlier quoted context omitted.
I too have learnt to like systemd. But what is the relevance here? In what way is it a replacement for docker?
> In what way is it a replacement for docker? Look at the man pages for `machinectl` (then `systemd-nspawn`, `systemd-vmspawn`, and if you want `systemd-portabled`). This is a replacement for docker. These are container tools offered by systemd.
Earlier quoted context omitted.
I too have learnt to like systemd. But what is the relevance here? In what way is it a replacement for docker?
> In what way is it a replacement for docker? Look at the man pages for `machinectl` (then `systemd-nspawn`, `systemd-vmspawn`, and if you want `systemd-portabled`). This is a replacement for docker. These are container tools offered by systemd.
Earlier quoted context omitted.
Because of how Docker works, not because of how Unix permissions work.
Unix has always had incredibly weak protections between users. You shouldn't rely on it as a security boundary. Think of it as a "keep honest users honest" protection. And llms are not honest.
Earlier quoted context omitted.
I think that's distro-specific. Some set it up with more secure defaults (unix socket with permissions), others less (TCP socket).
I don't really know of any distro that doesn't do that. All of Docker Inc. default installs and all of distros I know of don't automatically add you to the docker group. docker.com instructions has the infamous "linux post-install instructions" that explain and walk you though it. The tragedy is of course that when security and usability collide, 80/20 rule will apply where 80% of people will pick usability over secu…
Ironically that’s how Docker works on every platform where it’s running a non-native OS. On macOS that’s how all images are run. Linux on Linux is the only Docker combination that is particularly problematic from a security perspective.
Virtualisation has advanced greatly since docker was introduced, if your running in local hardware that’s supports virtualisation, Docker should be running images fully virtualised. There is no good reason to use the OS kernel for most use cases as the performance impact is negligible. If you need kernel access there are better options, like systemd containers.
Every time I try to install Docker there's a warning that being in the "docker" group is equivalent to having root access. You should probably know about this workaround by now.
Most of us install Docker just to run a project locally, and is part of a long checklist of things to install. We can't expect everyone to be an expert on the hundreds of apps/tools/packages that get installed on a machine. It's like expected people to read, and understand, all the terms of service shoved in front of us on a daily basis.
This is one of the main reasons people like Podman. Docker has this "feature" but as far as I remember, it needed some obscure configuration. I guess they don't add it as default as it will break many current setups.
curl -fsSL https://get.docker.com/rootless | sh
Earlier quoted context omitted.
Most of us install Docker just to run a project locally, and is part of a long checklist of things to install. We can't expect everyone to be an expert on the hundreds of apps/tools/packages that get installed on a machine. It's like expected people to read, and understand, all the terms of service shoved in front of us on a daily basis.
That's why adding your user account to the docker group is a separate step that explicitly does not happen as part of the installation: https://docs.docker.com/engine/install/linux-postinstall/ > Warning > The docker group grants root-level privileges to the user. For details on how this impacts security in your system, see Docker Daemon Attack Surface.
Huge design mistake if you ask me.
Earlier quoted context omitted.
Most of us install Docker just to run a project locally, and is part of a long checklist of things to install. We can't expect everyone to be an expert on the hundreds of apps/tools/packages that get installed on a machine. It's like expected people to read, and understand, all the terms of service shoved in front of us on a daily basis.
Most people buy scissors just to cut some paper. We can't expect everyone to recognize that they are sharp.
rootless docker. pain to install but can mitigate a catastrophe.
Earlier quoted context omitted.
No, Docker can run rootless too
This was not always true and running rootless has been a benefit of Podman for a long time. Docker also does not run rootless by default afaik, thus making the attack surface greater by default. The other main improvement of Podman over Docker is that Podman is daemonless and therefor is incredibly lightweight and portable.