News for hackers. Stuff that matters.

A comment on Building untrusted container images safely at scale. Parent comment

Re:Building untrusted container images safely at scale by amluto on Monday June 30, 2025 @12:22AM (#44419344)
Maybe the default form of RUN is kinda sorta safe [0].

How about ADD? Or COPY? Or RUN —-mount=type=bind,rw…?

Over the last ten years or so we’ve progressed from subtle-ish security holes due to memory unsafety and such to shiny tools in shiny safe languages that have absolutely gaping security and isolation holes by design. Go us.

[0] There is some serious wishful thinking involved there.

[ Parent | on HN ]
Re:Building untrusted container images safely at scale by ptx on Monday June 30, 2025 @05:03PM (#44427852)
> Or RUN —-mount=type=bind,rw…?

This seems to be pretty safe, according to the docs, if I understand them correctly. A bind mount can only mount "context directories" and the rw option will discard the written data, it says.

[ Parent | on HN ]
Re:Building untrusted container images safely at scale by amluto on Monday June 30, 2025 @06:33PM (#44428649)
No way, you're right, they actually tried to make it kind of sensible.

Too bad there's also:

Steal my credentials (temporarily, but still...) to access remote systems without restriction:

    RUN --mount=type=ssh
Access TCP and UDP ports without restriction, including anything exported by any other container I'm running, because Docker has no real security model

    RUN --network=host
Outright pwn me, but only if "entitiled":

    RUN --security=insecure
[ Parent | on HN ]