News for hackers. Stuff that matters.

A comment on A Docker footgun led to a vandal deleting NewsBlur's MongoDB database. Parent comment

Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by eru on Tuesday June 29, 2021 @02:08AM (#27672404)
Alternatively, running all your services as VMs also helps.

Having root in a VM doesn't typically give you any rights on the hypervisor (at least not on eg Xen).

[ Parent | on HN ]
Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by ahepp on Tuesday June 29, 2021 @05:25AM (#27673634)
Well, if they get root on your mongo vm they can still drop all your tables (or ransomware you) right? So would it make a difference in this particular case? Outside the VM tooling probably not being so insane as to bypass the firewall?
[ Parent | on HN ]
Re:A Docker footgun led to a vandal deleting NewsBlur's Mong... by eru on Tuesday June 29, 2021 @07:35AM (#27674420)
Well, in this case docker was trying to be helpful.

On a hypervisor, it's much harder for VMs to influence each other.

Linux containers (and docker amongst them) started out as convenient and reasonably performant, and added security later. One patch at a time.

Historically, hypervisors typically started secure and added performance and convenience over time.

(Very simplified. But I used to work for XenSource back in the day.)

[ Parent | on HN ]