News for hackers. Stuff that matters.

A comment on AinD: Android in Docker. Parent comment

Re:AinD: Android in Docker by londons_explore on Friday April 10, 2020 @08:12AM (#22832205)
I think you're putting too much faith in the security of docker... It is only superficially secure, and any real evil software can break out of it since the attack surface is huuuge (every loaded kernel driver).
[ Parent | on HN ]
Re:AinD: Android in Docker by rtempaccount1 on Friday April 10, 2020 @11:17AM (#22833869)
Docker has a number of security layers that can make breakout more challenging, specifically dropped capabilities, a seccomp filter and (on debian/ubuntu) an AppArmor profile installed.

I wouldn't agree that it's trivially possible to breakout of a default configured Docker container, not every attacker is packing a Linux Privesc 0-day and the knowledge to use it.

[ Parent | on HN ]
Re:AinD: Android in Docker by fulafel on Friday April 10, 2020 @11:34AM (#22834074)
It's telling that user namespaces (remapping uid 0 to another hodt uid) aren't used by default.
[ Parent | on HN ]