Re:Disabling Docker ICC still allows raw ethernet communicat...
by kentonv on Wednesday February 21, 2018 @10:32AM
(#16430123)
> I can't find too much information on this, does docker mount /proc from the host by default in each of the containers?
Sorry, I should have clarified: It's /proc for the specific PID namespace. So in theory it doesn't leak anything bad. The problem is that it's a huge attack surface; there have been bugs in /proc before.
> I think that sandboxing the language is pretty tough in the general case, since every language takes a lot of effort. In non-managed, compiled languages, it will be even tougher.
WebAssembly sandboxes non-managed compiled languages pretty well. :)
> What is your opinion on tools like SELinux as a secondary layers?
IMO it doesn't help very much, because many of the kinds of kernel bugs that allow you to escape a container tend to allow you to escape SELinux as well.
Sorry, I should have clarified: It's /proc for the specific PID namespace. So in theory it doesn't leak anything bad. The problem is that it's a huge attack surface; there have been bugs in /proc before.
> I think that sandboxing the language is pretty tough in the general case, since every language takes a lot of effort. In non-managed, compiled languages, it will be even tougher.
WebAssembly sandboxes non-managed compiled languages pretty well. :)
> What is your opinion on tools like SELinux as a secondary layers?
IMO it doesn't help very much, because many of the kinds of kernel bugs that allow you to escape a container tend to allow you to escape SELinux as well.