11–20 of 75 posts
> barco enforces a minimal set of restrictions to run untrusted code, which is not recommended for production use, where a more robust solution should be used. Aren't containers never suitable for running untrusted code? You need AppArmor, bwrap, or similar AFAIK.
They are suitable provided the kernel is secure.
Earlier quoted context omitted.
Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.
GP was asking if it could cause an issue for the OP, not complaining about an annoyance. It's something that the OP may want to address.
With that context, I doubt that name collisions outside of the containers space are top of mind.
Earlier quoted context omitted.
GP was asking if it could cause an issue for the OP, not complaining about an annoyance. It's something that the OP may want to address.
I still think it is tangential. The author stated that they wrote this project to learn. The readme says that it is not intended for production use and that there is no networking set up in the containers. With that context, I doubt that name collisions outside of the containers space are top of mind.
> barco enforces a minimal set of restrictions to run untrusted code, which is not recommended for production use, where a more robust solution should be used. Aren't containers never suitable for running untrusted code? You need AppArmor, bwrap, or similar AFAIK.
Jessica Frazelle ran a public bug bounty to break out of a container image that is properly secured, and as far as I know nobody collected the bounty. The website isn't up at the moment, maybe she took it down. https://contained.af/
Very cool, I was thinking of doing something similar in windows
> barco enforces a minimal set of restrictions to run untrusted code, which is not recommended for production use, where a more robust solution should be used. Aren't containers never suitable for running untrusted code? You need AppArmor, bwrap, or similar AFAIK.
>Aren't containers never suitable for running untrusted code? They are suitable provided the kernel is secure.
The more nuanced answer is that containers have several layers of protections (seccomp, LSMs, user namespaces, namespaces, cgroups, capabilities, and standard process permissions by running as an unprivileged user) which all act together to help protect against container attacks. It's not perfect, but most container breakout attacks we've had so far are related to when container runtimes have to operate on a container during process setup (IMHO because the process for creating a container process is far from atomic) -- some of these attacks were enabled by kernel bugs which we went and fixed as well. It is very difficult to break out of a container once it has been configured and left alone.
> barco enforces a minimal set of restrictions to run untrusted code, which is not recommended for production use, where a more robust solution should be used. Aren't containers never suitable for running untrusted code? You need AppArmor, bwrap, or similar AFAIK.
bwrap is a container and AppArmor is used by basically every container runtime if the system is using AppArmor (otherwise they use SELinux). Seccomp is also enabled by default, and I would argue it is a more significant protection against container breakouts because it protects against kernel 0-days as well and doesn't rely on LSM hooks to block operations. The real question is whether you are using user namespaces.…
Earlier quoted context omitted.
bwrap is a container and AppArmor is used by basically every container runtime if the system is using AppArmor (otherwise they use SELinux). Seccomp is also enabled by default, and I would argue it is a more significant protection against container breakouts because it protects against kernel 0-days as well and doesn't rely on LSM hooks to block operations. The real question is whether you are using user namespaces.…
Sounds like free money to me. You just press Ctrl+D, and you're out.
Earlier quoted context omitted.
I still think it is tangential. The author stated that they wrote this project to learn. The readme says that it is not intended for production use and that there is no networking set up in the containers. With that context, I doubt that name collisions outside of the containers space are top of mind.
barco really just means "hay barrack" in my native language ¯\_(ツ)_/¯
In what language does it mean 'hay barrack'?