Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex just found a "workaround" of not having sudo on my PC

twitter.com

Post reply on HN
Print view View original

181–190 of 330 posts

Re: Codex just found a "workaround" of not having sudo on my PC

#181

Post by Kaliboy »

itintheory wrote: post #166
Root_Denied wrote: post #131

Earlier quoted context omitted.

My understanding is that docker will expose the ports to the host machine's network interfaces, which is a crucial difference. For my home server running docker that means exposed to the LAN, but not the WAN unless I add in a port forwarding rule on my router. Similarly in an enterprise environment you would be exposing the port on whatever VLAN the host is connected to, which hopefully doesn't have directly transit…

I was thinking along similar lines to what you've suggested here, but then I considered how many VPS might be configured by folks following some random web tutorial, to set up their LAMP stack (or whatever), that end up doing something like what was described.

But there it's a feature.

Re: Codex just found a "workaround" of not having sudo on my PC

#184

Post by Kaliboy »

Zopieux wrote: post #120
righthand wrote: post #111

Earlier quoted context omitted.

This was not always true and running rootless has been a benefit of Podman for a long time. Docker also does not run rootless by default afaik, thus making the attack surface greater by default. The other main improvement of Podman over Docker is that Podman is daemonless and therefor is incredibly lightweight and portable.

I don't understand why anyone still uses docker.

Inertia I guess... We try. I managed to remove it everywhere in our stack in CI and such but in dev everyone is used to docker build.

And I don't have the energy for the team meeting to discuss a change.

And honestly docker compose has been ridiculously stable for us. 2+ services on seperate servers behind haproxy has been as stable as our Kubernetes Cluster for a fraction of the (intellectual) cost.

Re: Codex just found a "workaround" of not having sudo on my PC

#185

Post by LeFantome »

SpaceNoodled wrote: post #156
HeWhoLurksLate wrote: post #140

Earlier quoted context omitted.

wait so just being lazy and using sudo on Docker commands instead of figuring things out actually means I'm being safer? awesome.

This feels like using Docker is just inherently unsafe.

The fact that Docker is unsafe was one of the core motivations for Podman.

Re: Codex just found a "workaround" of not having sudo on my PC

#186

Post by LeFantome »

alsetmusic wrote: post #169
itintheory wrote: post #163

Earlier quoted context omitted.

This feels like using sudo is just inherently unsafe.

This feels like using a computer is inherently unsafe. On the plus side, once we outlaw them we'll shut down the ability for conspiratorial thinking to spread easily and the world will slowly heal from the last couple of decades (the previous one in particular). Hooray! We're finally doing something about the harms of social media. Smash your computer today!

Safety meeting. Nobody works, nobody gets hurt.

Re: Codex just found a "workaround" of not having sudo on my PC

#187

Post by smarnach »

Kaliboy wrote: post #181
itintheory wrote: post #166

Earlier quoted context omitted.

I was thinking along similar lines to what you've suggested here, but then I considered how many VPS might be configured by folks following some random web tutorial, to set up their LAMP stack (or whatever), that end up doing something like what was described.

But there it's a feature.

Except for the M in LAMP.

Re: Codex just found a "workaround" of not having sudo on my PC

#188

Post by LeFantome »

ventana wrote: post #77
jonny_eh wrote: post #59

Earlier quoted context omitted.

Most of us install Docker just to run a project locally, and is part of a long checklist of things to install. We can't expect everyone to be an expert on the hundreds of apps/tools/packages that get installed on a machine. It's like expected people to read, and understand, all the terms of service shoved in front of us on a daily basis.

That's true, the majority of people probably install software without much thinking; but it's also true that it's always better to have at least some high level understanding how the specific piece of software works. What access the given software has, will it send something over the network or work locally; that kind of stuff. As for Docker, I would assume everyone who ever tried to bind-mount a volume for writing f…

Docker relies fundamentally on the Linux kernel. Since macOS does not have a Linux kernel, you have to run Linux in a VM first and then run Docker on top of that.

So, you may get filesystem access inside the VM. Breaking out of the VM may be a different matter.

Re: Codex just found a "workaround" of not having sudo on my PC

#189

Post by gruez »

itintheory wrote: post #163
SpaceNoodled wrote: post #156

Earlier quoted context omitted.

This feels like using Docker is just inherently unsafe.

This feels like using sudo is just inherently unsafe.

This but unironically. There's no way to ensure that nobody overwrote your .profile or .bashrc with a backdoored sudo that steals your password, or runs your command and then runs an evil command afterwards.
Post reply on HN