Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Bug Allows Root Access to Host Filesystem

decipher.sc

Post reply on HN
Print view View original

41–50 of 60 posts

Re: Docker Bug Allows Root Access to Host Filesystem

#41

Post by zantana »

djsumdog wrote: post #37
cyphar wrote: post #16

Earlier quoted context omitted.

If you take a look at LXC and LXD, I would very much argue you can use them as a security boundary. One of the main problems with Docker is that the most powerful isolation primitive available in Linux -- user namespaces -- is not used by default and doesn't fully utilise the underlying feature. LXC uses unprivileged user namespaces by default, and LXD defaults to user namespaces as well. You can even isolate contain…

I wish it were possible to run Docker as a regular user, or run a separate Docker in Docker in CI (I assume the Docker CI runners on things like Gitlab are running as root or shared via `-v /var/run/docker.sock:/var/run/docker.sock` since Docker-in-Docker is only recommended for actually developing Docker)

Docker is a front end to underlying technologies which do the work.

Red Hat created a Kubernetes compatible set of tools for running Docker compatible OCI containers called CRI-O https://cri-o.io/ with RHEL/Centos 7.7 and 8+ you can run containers as a regular user: https://www.redhat.com/en/blog/preview-running-containers-wi... using their tools.

Re: Docker Bug Allows Root Access to Host Filesystem

#42

Post by nmjohn »

arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

If you believe containers cannot be secure, than you should be able to capture the flag and get paid for beating https://contained.af/

Having said that, I agree that by default containers are a poor security boundary - but saying they are wholesale inadequate is not accurate.

Re: Docker Bug Allows Root Access to Host Filesystem

#43

Post by breser »

djsumdog wrote: post #37
cyphar wrote: post #16

Earlier quoted context omitted.

If you take a look at LXC and LXD, I would very much argue you can use them as a security boundary. One of the main problems with Docker is that the most powerful isolation primitive available in Linux -- user namespaces -- is not used by default and doesn't fully utilise the underlying feature. LXC uses unprivileged user namespaces by default, and LXD defaults to user namespaces as well. You can even isolate contain…

I wish it were possible to run Docker as a regular user, or run a separate Docker in Docker in CI (I assume the Docker CI runners on things like Gitlab are running as root or shared via `-v /var/run/docker.sock:/var/run/docker.sock` since Docker-in-Docker is only recommended for actually developing Docker)

It is possible to run Docker in Docker in CI. At a previous job I built containers that ran docker as Bamboo build agents. The containers did not use the docker socket and instead had their own and their own `/var/lib/docker` directory. However, the containers have to run docker as root (I started docker and then dropped privileges to run the bamboo agent) and have to run with the `--privileged` option. The advantage of doing it that way was that the hosts image storage was cleaned up with the containers and separate from the host. Disadvantage was that you have to use loopback based storage which makes docker a little slower. I don't think there's a huge difference in security since docker would end up being accessible via the socket anyway and by dropping privileges for the build agent you're losing the capabilities that you get from `--privileged`.

Re: Docker Bug Allows Root Access to Host Filesystem

#44

Post by laumars »

Tepix wrote: post #26
laumars wrote: post #23

Earlier quoted context omitted.

Isolation doesn't mean secure. Some containerisation solutions are designed to provide a security mechanism. Other containerisation solutions, such as Docker, are designed as a development and/or orchestration tool. I do agree that a it's important to have defence in depth

His statement was: "but containers and Docker specifically shouldn't be used to isolate systems for security". Well, thousands of companies, such as ISPs offering VPS are using containers for exactly that reason. Containers use cgroups under the hood, a Linux kernel feature that limits, accounts for, and isolates the resource usage (CPU, memory, disk I/O, network, etc.) of a collection of processes. As long as there…

I'm not suggesting all containers shouldn't be used for security. I'm just saying docker - specifically - isn't an isolation tool that's was designed primarily as a security tool. There are other solutions on Linux if you want security - such as LXC and OpenVZ - which I suspect is what those ISPs you're referring to use.

The problem with docker isn't at the kernel level, it's the userspace tooling. It's pretty insecure by default. For example it creates bridged networks as the default network interface and actively encourages (by design) developers to run code as root (since creating non-root users then becomes a manual RUN command). Then you have vulnerabilities in the user space tools to contend with in addition to the same concerns about sharing a kernel that crop up when discussing security and containerisation. That said, there are some stuff it does right from a security standpoint but generally speaking docker is a tool you need to harden rather than something that comes hardened.

I don't hate docker though. It's a great productivity tool and it can be run securely if you have proper defence of depth. But I would advise against running docker as your only sandboxing. To be honest, I'd advise security at all levels regardless of the docker discussion anyway.

Re: Docker Bug Allows Root Access to Host Filesystem

#45

Post by icedchai »

Tepix wrote: post #26
laumars wrote: post #23

Earlier quoted context omitted.

Isolation doesn't mean secure. Some containerisation solutions are designed to provide a security mechanism. Other containerisation solutions, such as Docker, are designed as a development and/or orchestration tool. I do agree that a it's important to have defence in depth

His statement was: "but containers and Docker specifically shouldn't be used to isolate systems for security". Well, thousands of companies, such as ISPs offering VPS are using containers for exactly that reason. Containers use cgroups under the hood, a Linux kernel feature that limits, accounts for, and isolates the resource usage (CPU, memory, disk I/O, network, etc.) of a collection of processes. As long as there…

Huh? Most VPSes are virtual machines (likely KVM, possible Xen, based), and are not using Docker at all.

Re: Docker Bug Allows Root Access to Host Filesystem

#46

Post by the8472 »

PyroLagus wrote: post #35
cyphar wrote: post #16

Earlier quoted context omitted.

If you take a look at LXC and LXD, I would very much argue you can use them as a security boundary. One of the main problems with Docker is that the most powerful isolation primitive available in Linux -- user namespaces -- is not used by default and doesn't fully utilise the underlying feature. LXC uses unprivileged user namespaces by default, and LXD defaults to user namespaces as well. You can even isolate contain…

Apparently even user namespaces can't be trusted for secure isolation, so much so that Arch Linux even has them disabled by default[1]. That said, it's possible that security improved since then, and I don't know when the most recent user namespace vulnerability was found. [1] https://lists.archlinux.org/pipermail/arch-general/2017-Febr...

That mail is outdated. Arch, like some other distros such as debian, now applies a kernel patch that allows toggling userns support via kernel.unprivileged_userns_clone sysctl.

Re: Docker Bug Allows Root Access to Host Filesystem

#47

Post by the8472 »

djsumdog wrote: post #37
cyphar wrote: post #16

Earlier quoted context omitted.

If you take a look at LXC and LXD, I would very much argue you can use them as a security boundary. One of the main problems with Docker is that the most powerful isolation primitive available in Linux -- user namespaces -- is not used by default and doesn't fully utilise the underlying feature. LXC uses unprivileged user namespaces by default, and LXD defaults to user namespaces as well. You can even isolate contain…

I wish it were possible to run Docker as a regular user, or run a separate Docker in Docker in CI (I assume the Docker CI runners on things like Gitlab are running as root or shared via `-v /var/run/docker.sock:/var/run/docker.sock` since Docker-in-Docker is only recommended for actually developing Docker)

The issue is that if you want to communicate with the outside world you need to create a network bridge, which only a sufficiently privileged user on the host system can do.

An unprivileged-user docker daemon would be limited to either communicate with an isolated network namespace on the parent side or do userspace forwarding of network traffic. Or it would require a privileged helper for the network parts.

Re: Docker Bug Allows Root Access to Host Filesystem

#48

Post by laumars »

icedchai wrote: post #45
Tepix wrote: post #26

Earlier quoted context omitted.

His statement was: "but containers and Docker specifically shouldn't be used to isolate systems for security". Well, thousands of companies, such as ISPs offering VPS are using containers for exactly that reason. Containers use cgroups under the hood, a Linux kernel feature that limits, accounts for, and isolates the resource usage (CPU, memory, disk I/O, network, etc.) of a collection of processes. As long as there…

Huh? Most VPSes are virtual machines (likely KVM, possible Xen, based), and are not using Docker at all.

You do get container-based VPSes too. Though you're right they wouldn't be docker. Usually OpenVZ (last time I checked) but I've not kept up to date with LXC development.

Re: Docker Bug Allows Root Access to Host Filesystem

#49

Post by ploxiln »

nmjohn wrote: post #42
arnon wrote: post #2

This may be an unpopular opinion, but containers and Docker specifically shouldn't be used to isolate systems for security. It should be used to ease deployment.

If you believe containers cannot be secure, than you should be able to capture the flag and get paid for beating https://contained.af/ Having said that, I agree that by default containers are a poor security boundary - but saying they are wholesale inadequate is not accurate.

contained.af uses seccomp to block a bunch of syscalls that you would not block for a real service, for example socket()

Re: Docker Bug Allows Root Access to Host Filesystem

#50

Post by cpuguy83 »

djsumdog wrote: post #37
cyphar wrote: post #16

Earlier quoted context omitted.

If you take a look at LXC and LXD, I would very much argue you can use them as a security boundary. One of the main problems with Docker is that the most powerful isolation primitive available in Linux -- user namespaces -- is not used by default and doesn't fully utilise the underlying feature. LXC uses unprivileged user namespaces by default, and LXD defaults to user namespaces as well. You can even isolate contain…

I wish it were possible to run Docker as a regular user, or run a separate Docker in Docker in CI (I assume the Docker CI runners on things like Gitlab are running as root or shared via `-v /var/run/docker.sock:/var/run/docker.sock` since Docker-in-Docker is only recommended for actually developing Docker)

Good news, there is a lot of work on that front, including an official "rootless" distribution: https://get.docker.com/rootless

The main thing about it is cgroups are disabled and it requires userspace networking.

Here's a write-up on it: https://engineering.docker.com/2019/02/experimenting-with-ro...

Post reply on HN