Escaping Docker container using waitid() – CVE-2017-5123

Re:Escaping Docker container using waitid() – CVE-2017-5123 by hacknat on Friday December 29, 2017 @02:03PM (#16031205)

Because the Docker project doesn’t make money off of security. It is actually quite infuriating, because they have become the de facto container image standard. Most of their security has actually come from Twistlock (I am not a Twistlock employee, FYI). My recommendation to most Admins or Devs that are serious about container security is to let your developers use docker, but run your images with CRI-O on your servers: http://cri-o.io/

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by raesene9 on Friday December 29, 2017 @03:19PM (#16031722)

The docker project has done quite a bit of work on container security, so I'm not sure it's entirely fair to say that them not enabling user namespace by default is for that reason.

For example the work that was done on their seccomp filtering and apparmor profiles.

My guess would be that it's as User namespacing can introduce some issues (e.g. where mounting host filesystems), that they've decided the trade-offs aren't worth it.

Also looking at the CRI-O trello (https://trello.com/c/Ak2yMcpf/714-epic-cri-o-support-for-use...) it seems like user namespaces isn't even an option there yet?

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by eikenberry on Friday December 29, 2017 @03:18PM (#16031715)

Viewing docker containers as anything more than a bundling and deployment system is a mistake. While they might help with security they will never be completely secure and you should architect your deployments with that in mind.

Unless you are a giant enterprise shop with the resources to staff a decent sized K8s team, you should use the hosted solutions.

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by cpuguy83 on Friday December 29, 2017 @03:13PM (#16031689)

There are trade-offs to using userns and many ppl don't like the current set of trade-offs. In addition changing a default like this is a breaking change. Admins can enable userns by default in a daemon, but making it a hard-coded default is much more difficult.

It's not just a matter of enabling user ns. There is no support at the vfs layer for uid/gid mapping. This means in order to use it, images must be chowned with the remapped ID's. Per-container mappings are not supported for this reason (it would require copying and chowning the entire image for each container mapping).

Do you care to qualify your statement about CRI-O?

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by ecnahc515 on Friday December 29, 2017 @05:47PM (#16032552)

I recall seeing some patches submitted to make it possible to pass an uid/gid offset to the mount syscall at one point when people were implementing usernamespaces for container runtimes like docker. So is this fixable without having to make every file system implement this feature, or is there something else holding back better support for doing uid shifting for use with user namespaces?

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by cpuguy83 on Friday December 29, 2017 @05:52PM (#16032566)

That has not been accepted into the kernel. It's called "shiftfs", which basically let's you perform the uid/gid shift on mount.

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by zenlikethat on Friday December 29, 2017 @05:59PM (#16032600)

Nah, Docker has taken lots of strides in the right direction for security over the years, Twistlock or not, albeit with a few weird dangling remainders. They'd love to turn user ns on by default but it'd break lots of existing stuff. Many more users would be mad about having that on by default than leaving it off.

Disclaimer: I worked at Docker for 3 years.

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by nvarsj on Friday December 29, 2017 @02:10PM (#16031267)

CRI-O is bleeding edge. I'm not sure it's ready for production usage. But it looks very promising. The sooner we can all dump docker in kubernetes the better.

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by fpoling on Friday December 29, 2017 @04:23PM (#16032080)

Docker excels in image building especially now with multi-image Dockefile support. It seems all those alternatives to the Docker just gave up on providing anything on their own. The documentation typically starts "lets pull a docker image".

On the other hand the container runtime is straightforward. I recently discovered that one can run a docker image with a bash script and the unshare command and get a very tight security setup. That explains proliferation of various alternatives to Docker to run its images.

[ Parent | on HN ]