Re:LiteLLM Python package compromised by supply-chain attack
by imtringued on Wednesday March 25, 2026 @07:53AM
(#47516123)
What's particularly vexing is that there is this agentic sandboxing software called "container-use" and out of the box it requires you to add a user to the docker group because they haven't thought about what that really means and why running docker in that configuration option shouldn't be allowed, but instead they have made it mandatory as a default.
Re:LiteLLM Python package compromised by supply-chain attack
by ashishb on Wednesday March 25, 2026 @12:29PM
(#47519599)
> docker run super-evil-oci-container
1. That super evil OCI container still needs to find a vulnerability in Docker
2. You can run Docker in rootless mode e.g. Orbstack runs without root
Re:LiteLLM Python package compromised by supply-chain attack
by staticassertion on Wednesday March 25, 2026 @05:11PM
(#47523331)
They're suggesting that the attacker is in a position to `docker run`. Any attacker in that position has privesc to root, trivially.
Rootless mode requires unprivileged user namespaces, disabled on almost any distribution because it's a huge security hole in and of itself.
So it says right on the tin of my favorite distro: 'Warning: Beware that the docker group membership is effectively equivalent to being root! Consider using rootless mode below.' So # docker run super-evil-oci-container with a bind mount or two and your would-be attacker doesn't need to guess your sudo password.