Docker containers on the desktop
blog.jessfraz.com
Docker containers on the desktop
1–10 of 76 posts
Re: Docker containers on the desktop
#2The need for stuff like Docker is an admission that OS privilege isolation and resource management is woefully inadequate.
Re: Docker containers on the desktop
#3Has anyone built a GUI wrapper for Docker that would allow someone to one-click an app like this on a Win/Mac desktop?
Re: Docker containers on the desktop
#4Are Docker containers actually sensibly secure as sandboxes? I thought there were still some gaps that needed to be closed in the underlying tech for it to be as safe as virtualization?
Re: Docker containers on the desktop
#5Are Docker containers actually sensibly secure as sandboxes? I thought there were still some gaps that needed to be closed in the underlying tech for it to be as safe as virtualization?
It's a lot better than no attempt at sandboxing, but ultimately you're still at the mercy of a late addition to the linux kernel (cgroups), which isn't exactly the safest codebase to make major changes like this in.
Denial of Service attacks are probably more straightforward than in a virtualized environment; I'm sure you could find a way to starve the kernel for something.
That said, there's currently no trivial "now I'm root on the host box" option or anything.
Re: Docker containers on the desktop
#6Has anyone built a GUI wrapper for Docker that would allow someone to one-click an app like this on a Win/Mac desktop?
There is Kitematic for Macs, but it requires VirtualBox: https://kitematic.com
Re: Docker containers on the desktop
#7Are Docker containers actually sensibly secure as sandboxes? I thought there were still some gaps that needed to be closed in the underlying tech for it to be as safe as virtualization?
For my part what I care most about with Docker is not the ability to run something I don't "trust". That is, I would not trust or expect it to be safe enough to run code I expect to be malicious.
For me it's about creating a setup that is far more easy to reproduce in the face of e.g. system upgrades, setting up a new machine, as well as protection against stupid mistakes, and about containing state.
Re: Docker containers on the desktop
#8The need for stuff like Docker is an admission that OS privilege isolation and resource management is woefully inadequate.
Linus agrees: https://www.youtube.com/watch?v=5PmHRSeA2c8#t=298
Re: Docker containers on the desktop
#9The need for stuff like Docker is an admission that OS privilege isolation and resource management is woefully inadequate.
Actually, everything that enables Docker is provided by the OS. AppArmor, SELinux, cgroups are all isolation capabilities provided by Linux. What you're seeing is libraries building on it finally becoming high-level enough that regular people are able to take advantage of them.
Re: Docker containers on the desktop
#10This is not sandboxing. Quite the opposite, this gives the apps root access:
First of all, X11 is completely unsecure, the "sandboxed" app has full access to every other X11 client. Thus, its very easy to write a simple X app that looks for say a terminal window and injects key events (say using Xtest extension) in it to type whatever it wants. Here is another example that sniffs the key events, including when you unlock the lock screen: https://github.com/magcius/keylog
Secondly, if you have docker access you have root access. You can easily run something like:
docker run -v /:/tmp ubuntu rm -rf /tmp/*
Which will remove all the files on your system.