Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Bug Allows Root Access to Host Filesystem

decipher.sc

Post reply on HN
Print view View original

31–40 of 60 posts

Re: Docker Bug Allows Root Access to Host Filesystem

#31

Post by the8472 »

nullwasamistake wrote: post #22

Why don't people run containers in VM's? I don't get it, the only real selling point I can come up with for kernel level isolation is ability to over provision ram. And you shouldn't do that on a server anyways. It's perfectly possible to fire up a regular docker container inside KVM or whatever. With constant container security issues, why isn't this the norm?

You have more benefits such as sharing resources between containers (page cache, unix sockets, reflink copies, shared memory IPC) etc.

Exposing GPU resources is also a lot easier with containers than with VMs.

Re: Docker Bug Allows Root Access to Host Filesystem

#32

Post by qalmakka »

hclaria wrote: post #25
nullwasamistake wrote: post #22

Why don't people run containers in VM's? I don't get it, the only real selling point I can come up with for kernel level isolation is ability to over provision ram. And you shouldn't do that on a server anyways. It's perfectly possible to fire up a regular docker container inside KVM or whatever. With constant container security issues, why isn't this the norm?

that's what Intel Clear Containers and KataContainers are trying to do https://clearlinux.org/news-blogs/intel-clear-containers-now... https://katacontainers.io/

And also what Microsoft has been doing since a few years ago on Windows with Hyper-V isolation.

Re: Docker Bug Allows Root Access to Host Filesystem

#33

Post by the8472 »

hclaria wrote: post #28
Leynos wrote: post #8

Earlier quoted context omitted.

The suggestion in the linked post is a situation where the Docker daemon is being controlled via its API in a multi-tennant environment where user configuration files are loaded into the container via the cp endpoint. I could concieve of this being a risk if you allow users to create symlinks in the location where the configuration files are situated.

Except giving access to a docker daemon equals giving the root access to the machine because it's easy to do something such as : $ docker run -it -v /:/hostfs debian chroot /hostfs # I'm root !

The issue is an unprivileged container fooling the host, not the host intentionally escalating to root.

Re: Docker Bug Allows Root Access to Host Filesystem

#34

Post by tonyarkles »

tecleandor wrote: post #21
tty7 wrote: post #12

Earlier quoted context omitted.

huh, what do you chroot to apt-get/dnf ?

I think you can do that bootstrapping, for example, with debootstrap. (I'm talking by memory)

Absolutely correct. I've got a cross-compile toolchain set up right now that needs Debian (Ubuntu won't do because of different glibc versions in the cross-compile toolchains). I used debootstrap to make a basic Debian Stretch filesystem, chroot into that, and apt-get the remaining pieces and run the build. Works like a charm, no Docker required. And, unlike containers, it's intentionally persistent so future builds go very quickly.

Re: Docker Bug Allows Root Access to Host Filesystem

#35

Post by PyroLagus »

cyphar wrote: post #16
arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

If you take a look at LXC and LXD, I would very much argue you can use them as a security boundary. One of the main problems with Docker is that the most powerful isolation primitive available in Linux -- user namespaces -- is not used by default and doesn't fully utilise the underlying feature. LXC uses unprivileged user namespaces by default, and LXD defaults to user namespaces as well. You can even isolate contain…

Apparently even user namespaces can't be trusted for secure isolation, so much so that Arch Linux even has them disabled by default[1]. That said, it's possible that security improved since then, and I don't know when the most recent user namespace vulnerability was found.

[1] https://lists.archlinux.org/pipermail/arch-general/2017-Febr...

Re: Docker Bug Allows Root Access to Host Filesystem

#36

Post by geggam »

loudmax wrote: post #7
arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

Containerization certainly ought to be an isolation layer to boost security. What's unfortunate is how little we can rely on docker to provide any additional security.

Given that docker is simply an abstraction of the various kernel functions it is arguable that eliminating the docker piece and directly managing the kernel functions would be more secure.

Problem there is it requires a significant learning curve and when you get to that point you start evaluating the ROI of containers. Deployment is easy. Operations is easy. Until either one of the two fail. Then debugging becomes a seriously complex problem.

Re: Docker Bug Allows Root Access to Host Filesystem

#37

Post by djsumdog »

cyphar wrote: post #16
arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

If you take a look at LXC and LXD, I would very much argue you can use them as a security boundary. One of the main problems with Docker is that the most powerful isolation primitive available in Linux -- user namespaces -- is not used by default and doesn't fully utilise the underlying feature. LXC uses unprivileged user namespaces by default, and LXD defaults to user namespaces as well. You can even isolate contain…

I wish it were possible to run Docker as a regular user, or run a separate Docker in Docker in CI (I assume the Docker CI runners on things like Gitlab are running as root or shared via `-v /var/run/docker.sock:/var/run/docker.sock` since Docker-in-Docker is only recommended for actually developing Docker)

Re: Docker Bug Allows Root Access to Host Filesystem

#38

Post by ovi256 »

ownagefool wrote: post #24
dijit wrote: post #6

Earlier quoted context omitted.

That seems like lazy contrarianism. If you put docker inside a VM, and your hypervisor is running in a zone, and you have different zones based on ”role”. Then of course you get the benefits of the zone and the hypervisor. The parent said “docker solves deployment, not isolation”- if you get your isolation another way then there’s no issue with using docker.

Probably slightly more complicated that. Each and every isolation layer can be broken. Why are we using just one? Run well written software. As a user. In a cgroup. With SELinux. On a VM. On Different Tin. With a security monitoring. Patch.

>Run well written software. As a user. In a cgroup. With SELinux. On a VM. On Different Tin. With a security monitoring. Patch.

The analogy you're trying for is surely not that this is as likely to solve the deployement problem for most people just as "Eat food. Not too much. Mostly Plants" is to solve the obesity epidemic for most people ? Not at all ?

Re: Docker Bug Allows Root Access to Host Filesystem

#39

Post by [deleted] »

Tepix wrote: post #26
laumars wrote: post #23

Earlier quoted context omitted.

Isolation doesn't mean secure. Some containerisation solutions are designed to provide a security mechanism. Other containerisation solutions, such as Docker, are designed as a development and/or orchestration tool. I do agree that a it's important to have defence in depth

His statement was: "but containers and Docker specifically shouldn't be used to isolate systems for security". Well, thousands of companies, such as ISPs offering VPS are using containers for exactly that reason. Containers use cgroups under the hood, a Linux kernel feature that limits, accounts for, and isolates the resource usage (CPU, memory, disk I/O, network, etc.) of a collection of processes. As long as there…

[deleted]

Re: Docker Bug Allows Root Access to Host Filesystem

#40

Post by djsumdog »

laumars wrote: post #19
arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

Is that an unpopular opinion? I don't think I see many people who do argue about docker from a security standpoint. At least nobody credible. Docker has always been sold as more of an development and orchestration tool than a security one.

I wrote an article not too long ago, both on Docker orchestration and security:

https://penguindreams.org/blog/my-love-hate-relationship-wit...

Post reply on HN