News for hackers. Stuff that matters.

A comment on Root your Docker host in 10 seconds for fun and profit (2017). Parent comment

Re:Root your Docker host in 10 seconds for fun and profit (2... by zmgsabst on Tuesday May 28, 2024 @07:55AM (#40499792)
Docker has had security and isolation features since it was competing with LXC on who glued cgroups and namespaces together better — and discussed in those terms the whole time.

While I agree that Docker as written isn’t good at security, your post has big “they’re holding the iPhone wrong!” vibes — and seemingly ignores the historic reasons that people would think it provides security.

[ Parent | on HN ]
Re:Root your Docker host in 10 seconds for fun and profit (2... by beeboobaa3 on Tuesday May 28, 2024 @08:00AM (#40499819)
> your post has big “they’re holding the iPhone wrong!” vibes

More like "it just isn't meant to be used for that". At least not in the default configuration, and that's fine!

> seemingly ignores the historic reasons that people would think it provides security

I've been using docker since it was announced. People have always been very clear that docker is not a security boundary, at least not with its default configuration.

[ Parent | on HN ]
Re:Root your Docker host in 10 seconds for fun and profit (2... by gtirloni on Tuesday May 28, 2024 @08:29AM (#40500052)
I think your point is valid. Docker was indeed all about developer productivity in the beginning and it's up to infrastructure operator to lock it down.
[ Parent | on HN ]
Re:Root your Docker host in 10 seconds for fun and profit (2... by zmgsabst on Tuesday May 28, 2024 @09:28AM (#40500549)
> People have always been very clear that docker is not a security boundary, at least not with its default configuration.

I’ve also used it since the beginning and that’s some mighty strong revisionism.

Docker was compared to VMs — with a tiny asterisk of fine print that it’s not actually configured to employ security features it’s built with.

[ Parent | on HN ]
Re:Root your Docker host in 10 seconds for fun and profit (2... by beeboobaa3 on Tuesday May 28, 2024 @09:46AM (#40500717)
> Docker was compared to VMs

By certain people, yes. They have always been wrong. Never by the docker team themselves.

[ Parent | on HN ]