Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex just found a "workaround" of not having sudo on my PC

twitter.com

Post reply on HN
Print view View original

131–140 of 330 posts

Re: Codex just found a "workaround" of not having sudo on my PC

#131

Post by Root_Denied »

pqdbr wrote: post #118
throwawaypath wrote: post #10

This has been a known Docker "feature" since the beginning, nothing new here. This pattern is used to configure host machines by some tools.

Like the known Docker "feature" that it completely bypasses UFW and unless your ports look like "- 127.0.0.1:PORT:PORT" (and many of the examples use "-PORT:PORT") you expose everything to the internet?

My understanding is that docker will expose the ports to the host machine's network interfaces, which is a crucial difference. For my home server running docker that means exposed to the LAN, but not the WAN unless I add in a port forwarding rule on my router. Similarly in an enterprise environment you would be exposing the port on whatever VLAN the host is connected to, which hopefully doesn't have directly transit to the open internet.

Anything you're running on the perimeter with open access to the internet in an enterprise environment probably (hopefully) isn't running docker containers without some additional config and protections.

Re: Codex just found a "workaround" of not having sudo on my PC

#133

Post by vdfs »

nicoburns wrote: post #89
CSMastermind wrote: post #42

I realize this is supposed to be a post about how scary the security vulnerabilities these agents will find are. But personally I love when agents do things like this and appreciate the help. Last thing in the world I want is for them to nerf the models.

In this case I think it's Docker that needs to be nerfed, not the models. The fact that there's a backdoor to getting root access on the machine would be a problem even if you weren't running LLMs on it.

It's like finding someone wallet then going to their home, and leaving it on their bedroom and sending them a message about giving them their wallet back

Re: Codex just found a "workaround" of not having sudo on my PC

#134

Post by vixalien »

3abiton wrote: post #117
dbacar wrote: post #18

This is one of the main reasons people like Podman. Docker has this "feature" but as far as I remember, it needed some obscure configuration. I guess they don't add it as default as it will break many current setups.

Podman has lots of underappreciated features, and it's fully open-source!

hmmm, care to tell us a few of them?

Re: Codex just found a "workaround" of not having sudo on my PC

#135

Post by WesolyKubeczek »

I remember reading a book, Red Hat Linux System Administration Unleashed from 2000, where it has been postulated that knowing several tools with overlapping functionality is an essential skill, as you may end up on a broken or intentionally crippled system where, say, ls is unavailable, and you may need to cobble it together from shell and awk and what have you.

Back then you could indeed run a risk of having /usr nibbled by a grue such that it wouldn’t mount on the next boot, or you could get pwned and half of coreutils would turn into explosive pumpkins.

I’m pretty sure we are past many of the threats listed in that book, but the skill is still useful, as can be seen.

Re: Codex just found a "workaround" of not having sudo on my PC

#137

Post by halfcat »

amelius wrote: post #127
Ajedi32 wrote: post #95

Earlier quoted context omitted.

That's why adding your user account to the docker group is a separate step that explicitly does not happen as part of the installation: https://docs.docker.com/engine/install/linux-postinstall/ > Warning > The docker group grants root-level privileges to the user. For details on how this impacts security in your system, see Docker Daemon Attack Surface.

And containers were supposed to make things safer ... Huge design mistake if you ask me.

Containers were never a security boundary

Re: Codex just found a "workaround" of not having sudo on my PC

#138

Post by bionade24 »

chrisweekly wrote: post #31
AlexCoventry wrote: post #24

Run coding agents in a docker container with limited permissions. FWIW, I run it with --cap-drop=ALL --pids-limit=4096 --runtime=runsc

Or put it in a microvm using eg smolmachines.

Using runsc instead of runsc means that there's a hypervisor layer (gvisor, probably) in-between the kernel and the container userland

Re: Codex just found a "workaround" of not having sudo on my PC

#139

Post by lostlogin »

sublinear wrote: post #109
moomin wrote: post #84

Earlier quoted context omitted.

A lot of us don’t get a choice.

You can run plain old CLI Docker ( not Docker Desktop) from within WSL.

Wish the Mac Desktop Docker would die in a hellfire. CLI please.

Re: Codex just found a "workaround" of not having sudo on my PC

#140

Post by HeWhoLurksLate »

Ajedi32 wrote: post #95
jonny_eh wrote: post #59

Earlier quoted context omitted.

Most of us install Docker just to run a project locally, and is part of a long checklist of things to install. We can't expect everyone to be an expert on the hundreds of apps/tools/packages that get installed on a machine. It's like expected people to read, and understand, all the terms of service shoved in front of us on a daily basis.

That's why adding your user account to the docker group is a separate step that explicitly does not happen as part of the installation: https://docs.docker.com/engine/install/linux-postinstall/ > Warning > The docker group grants root-level privileges to the user. For details on how this impacts security in your system, see Docker Daemon Attack Surface.

wait so just being lazy and using sudo on Docker commands instead of figuring things out actually means I'm being safer? awesome.
Post reply on HN