A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by onebike on Monday June 28, 2021 @11:13PM (#27671289)

This (Docker opening a hole in my firewall) is why I moved my dev server from Linode to Digital Ocean. DO provides a “cloud firewall” that provides something akin to AWS security groups and therefore can’t be messed by Docker. Linode doesn’t have anything like that (last time I checked at least).

[ Parent | on HN ]

Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by bombcar on Monday June 28, 2021 @11:48PM (#27671541)

This is perhaps the best arguments I’ve seen for a separate firewall device even if it’s in the cloud (and just software) - something on your box running as root may bypass your rules just to help you.

[ Parent | on HN ]

Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by eru on Tuesday June 29, 2021 @02:08AM (#27672404)

Alternatively, running all your services as VMs also helps.

Having root in a VM doesn't typically give you any rights on the hypervisor (at least not on eg Xen).

[ Parent | on HN ]

Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by ahepp on Tuesday June 29, 2021 @05:25AM (#27673634)

Well, if they get root on your mongo vm they can still drop all your tables (or ransomware you) right? So would it make a difference in this particular case? Outside the VM tooling probably not being so insane as to bypass the firewall?

[ Parent | on HN ]

Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by eru on Tuesday June 29, 2021 @07:35AM (#27674420)

Well, in this case docker was trying to be helpful.

On a hypervisor, it's much harder for VMs to influence each other.

Linux containers (and docker amongst them) started out as convenient and reasonably performant, and added security later. One patch at a time.

Historically, hypervisors typically started secure and added performance and convenience over time.

(Very simplified. But I used to work for XenSource back in the day.)

[ Parent | on HN ]

Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by LinuxBender on Monday June 28, 2021 @11:46PM (#27671532)

They recently added one. In fact I had to move many of my VM's to new hypervisors because the ones that didn't support the cloud firewall were deprecated. I don't even use their cloud firewall.

[ Parent | on HN ]

Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by kyrra on Tuesday June 29, 2021 @12:56AM (#27671939)

I recently started hosting something on Linode, thanks for calling this feature out. It looks like they started launching Cloud Firewalls back in November. Full rollout was maybe April?

https://www.linode.com/blog/linode/cloud-firewall-beta-open/

[ Parent | on HN ]

Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by qbasic_forever on Tuesday June 29, 2021 @12:35AM (#27671805)

Make sure to flip on the feature though, it's not on by default last I saw spinning up some droplets a few months ago.

[ Parent | on HN ]