Re:Escaping Docker container using waitid() – CVE-2017-5123
by zenlikethat on Friday December 29, 2017 @05:42PM
(#16032530)
Mm, if you're bind mounting in the Docker socket, enabling user namespaces won't help much. You just have to deal with the fact that you have a privileged container (Docker API access == root, at least unless you're using authz). It'd be nice if we could see more RBAC around Docker API so you could do things like "grant only permission to run this one container".
[ Parent
| on HN ]
Re:Escaping Docker container using waitid() – CVE-2017-5123
by andbberger on Friday December 29, 2017 @05:58PM
(#16032597)
Totally. But the vast majority of containers I use do not get a bind mount to the Docker socket... for which user namespaces would be a very nice feature.
Re:Escaping Docker container using waitid() – CVE-2017-5123
by zenlikethat on Friday December 29, 2017 @06:02PM
(#16032616)
Yeah, definitely turn it on where possible, just important to realize that it's not a panacea (some people really hyped it up to be before the feature was released and criticized Docker for not having it at all). As always, gotta try and find the right sweet spot between convenience and attack surface.