The need for stuff like Docker is an admission that OS privilege isolation and resource management is woefully inadequate.
Linus agrees: https://www.youtube.com/watch?v=5PmHRSeA2c8#t=298
25:50 as well.
Docker containers on the desktop
21–30 of 76 posts
Re: Docker containers on the desktop
#22This is a great idea. I think the criticisms should be more ideas for improvement because this is definitely the future.
Re: Docker containers on the desktop
#23Earlier quoted context omitted.
Not sure what you mean, any user with access to docker can run processes as root, with any part of the host system mounted into the container. Now, that access was not added by you, but its required to be able to run your images. Once you have the images running the code in them could easily break out of the container via X11, and do things like sniff all keyboard events and inject events into any app. Of course, the…
yes but you are kinda ruining the point, this is a fun hack with Docker, take it or leave it, that's all.
What is he ruining by pointing out security vulnerabilities in this "fun hack"? (Something you're claiming in that blog post is beneficial, so I'm not exactly buying your retroactive characterization here.)
This sort of thing is irresponsible without the proper explanation of the dangers involved.
Re: Docker containers on the desktop
#24The need for stuff like Docker is an admission that OS privilege isolation and resource management is woefully inadequate.
Isolation is possible in a multi-user system with text-mode apps (ncurses and such), just xorg presents a privilege hole that can't be easily plugged. One way to do it may be to run a separate instance of X inside the container and access it via VNC from the host system.
It looks like the situation is somewhat better in Wayland?
http://mupuf.org/blog/2014/02/19/wayland-compositors-why-and...
Re: Docker containers on the desktop
#25Earlier quoted context omitted.
yes but you are kinda ruining the point, this is a fun hack with Docker, take it or leave it, that's all.
What is he ruining by pointing out security vulnerabilities in this "fun hack"? (Something you're claiming in that blog post is beneficial, so I'm not exactly buying your retroactive characterization here.) This sort of thing is irresponsible without the proper explanation of the dangers involved.
Yes, see Qubes to understand the level of effort required for robust isolation between desktop AppVMs.
Re: Docker containers on the desktop
#26Earlier quoted context omitted.
What is he ruining by pointing out security vulnerabilities in this "fun hack"? (Something you're claiming in that blog post is beneficial, so I'm not exactly buying your retroactive characterization here.) This sort of thing is irresponsible without the proper explanation of the dangers involved.
Yes, see Qubes to understand the level of effort required for robust isolation between desktop AppVMs.
Totally. It's not a simple task, and what this post describes creates a threat model that I would generously term "dire."
Re: Docker containers on the desktop
#27Ignoring X11 security, I have also used this technique successfully in certain situations. See: https://github.com/samtstern/android-vagrant
That allows anyone on Linux to download, install, and run Android Studio with a single 'docker run ...' command, and for Mac/Windows users to do the same within a VM using just 'vagrant up'. It's not something I'd use to run Android Studio myself, but it's great to get someone quickly up and running without messing with all of the environment headaches (Android SDK location, Java version, etc).
Re: Docker containers on the desktop
#28This is neat.
But.
Docker isn't sandboxing in a security sense. It's sandboxing in a deployment sense: given a friendly app and a friendly host, the app can get an environment it wants without bothering the host to adapt too much. Given two friendly apps and a friendly host, the two apps can see different environments.
Given an unfriendly app, Docker is no different from running the unfriendly app directly.
I think the really cool thing about this is that, given how straightforward these examples look, you can use this as a deployment platform: go use whatever weird Linux distro you want, and still be able to run software that's only supported on an Ubuntu LTS.
But I think the comparison to Apple's sandbox is misleading, and also vaguely unfair to the good work that Apple has done in building a security sandbox.
Re: Docker containers on the desktop
#29Earlier quoted context omitted.
Not sure what you mean, any user with access to docker can run processes as root, with any part of the host system mounted into the container. Now, that access was not added by you, but its required to be able to run your images. Once you have the images running the code in them could easily break out of the container via X11, and do things like sniff all keyboard events and inject events into any app. Of course, the…
yes but you are kinda ruining the point, this is a fun hack with Docker, take it or leave it, that's all.
You wrote, "I know that the rest of my system is completely unaffected from anything the app does." This is unfortunately not true.
It's a fun hack, and I think if you said it was a fun hack instead of a security measure you'd have gotten a different reaction. (I agree it's a fun hack! It's just not a security measure.)
Re: Docker containers on the desktop
#30Earlier quoted context omitted.
yes but you are kinda ruining the point, this is a fun hack with Docker, take it or leave it, that's all.
You wrote, "I know that the rest of my system is completely unaffected from anything the app does." This is unfortunately not true. It's a fun hack, and I think if you said it was a fun hack instead of a security measure you'd have gotten a different reaction. (I agree it's a fun hack! It's just not a security measure.)
The commands I give are fine.
The one Alex gives in his comment mounts root into a container, something I am not saying at all or even close doing at all. No one should ever mount root in a container, its common sense.