News for hackers. Stuff that matters.

A comment on Building untrusted container images safely at scale. Parent comment

Re:Building untrusted container images safely at scale by ptx on Monday June 30, 2025 @05:03PM (#44427852)
> Or RUN —-mount=type=bind,rw…?

This seems to be pretty safe, according to the docs, if I understand them correctly. A bind mount can only mount "context directories" and the rw option will discard the written data, it says.

[ Parent | on HN ]
Re:Building untrusted container images safely at scale by amluto on Monday June 30, 2025 @06:33PM (#44428649)
No way, you're right, they actually tried to make it kind of sensible.

Too bad there's also:

Steal my credentials (temporarily, but still...) to access remote systems without restriction:

    RUN --mount=type=ssh
Access TCP and UDP ports without restriction, including anything exported by any other container I'm running, because Docker has no real security model

    RUN --network=host
Outright pwn me, but only if "entitiled":

    RUN --security=insecure
[ Parent | on HN ]