Ask HN: Do you trust/install Docker in your personal computer?

#1

Post by coffekaesque » Tue, Jun 18, 2019, 12:03 AM UTC

I'm no longer using a separate computer from my employer and containers' security always worried me. Using VMs is very cumbersome in my opinion. I haven't used Docker in years, do you think it's safe enough now to install in your main computer (Linux host)? It's not like I'm going to test malware inside the containers but there's a lot of 3rd-party dependencies living there.

If you do trust Docker, what precautions would you take? Running without root is viable?

I'm aware of https://github.com/docker/docker-bench-security

Re: Ask HN: Do you trust/install Docker in your personal computer?

#2

Post by verdverm » Tue, Jun 18, 2019, 12:15 AM UTC

I think most people are ok running docker on their laptop / personal / work machines.

Running as non-root is totally viable, but root still seems to be the norm. You might look into configuring docker daemon to not open ports externally.

Re: Ask HN: Do you trust/install Docker in your personal computer?

#3

Post by jstewartmobile » Tue, Jun 18, 2019, 12:45 AM UTC

My Debian VM starts in seconds. Last docker image I had to use was Ubuntu, and it was enormous. For local purposes, I didn't really see the point to using a docker container.

That, and I don't particularly trust overlay filesystems.

Re: Ask HN: Do you trust/install Docker in your personal computer?

#4

Post by Tehchops » Tue, Jun 18, 2019, 12:58 AM UTC

I think being judicious about the source of your base images goes a long way towards safe usage.

Re: Ask HN: Do you trust/install Docker in your personal computer?

#5

Post by [deleted] » Tue, Jun 18, 2019, 12:58 AM UTC

[deleted]

Re: Ask HN: Do you trust/install Docker in your personal computer?

#6

Post by pella » Tue, Jun 18, 2019, 1:02 AM UTC

you can add extra safety like: https://gvisor.dev/ "A container sandbox runtime focused on security, efficiency, and ease of use."

Re: Ask HN: Do you trust/install Docker in your personal computer?

#7

Post by Wavelets » Tue, Jun 18, 2019, 1:04 AM UTC

What is your cause for concern?

Re: Ask HN: Do you trust/install Docker in your personal computer?

#8

Post by coffekaesque » Tue, Jun 18, 2019, 1:18 AM UTC

Wavelets wrote: post #7

What is your cause for concern?

Getting my pc compromised in any way. My data is very important for me, both personal and from clients. Or an attacker gaining access to my accounts or servers. I also don't like telemetry but that's outside this topic I guess.

Re: Ask HN: Do you trust/install Docker in your personal computer?

#9

Post by coffekaesque » Tue, Jun 18, 2019, 1:25 AM UTC

pella wrote: post #6

you can add extra safety like: https://gvisor.dev/ "A container sandbox runtime focused on security, efficiency, and ease of use."

That looks very good, thanks

Re: Ask HN: Do you trust/install Docker in your personal computer?

#10

Post by tracker1 » Tue, Jun 18, 2019, 1:29 AM UTC

verdverm wrote: post #2

I think most people are ok running docker on their laptop / personal / work machines. Running as non-root is totally viable, but root still seems to be the norm. You might look into configuring docker daemon to not open ports externally.

worth noting: for Docker Desktop (Mac and Windows), Docker itself is in a full VM, and not really the platform's root user.