Brief thoughts on Docker

Re:Brief thoughts on Docker by FooBarWidget on Sunday August 04, 2013 @06:31PM (#6157355)

Docker is great, but there is one security issue that it should solve. Right now, any user can manipulate any Docker container. If you create a container as root, then www-data can kill that container. The reason for this is because container orchestration is done through the Docker daemon, which listens on a TCP socket. Anybody on the local host can access that socket. They should, at the very least, implement password protection.

Today I also found out that it's not possible to run Docker inside Docker. :( I'm working on a Docker-based continuous integration system similar to Travis, and it would be great if I can distribute the CI system as a Docker container.

[ Parent | on HN ]

Re:Brief thoughts on Docker by icebraining on Sunday August 04, 2013 @06:42PM (#6157390)

You can actually configure Docker to use an Unix socket instead of TCP[1]. It seems it still opens it up to every user (it runs a chmod 777 on it), but you can always enforce stricter controls (e.g. with SELinux).

[1] https://github.com/dotcloud/docker/pull/938

[ Parent | on HN ]

Re:Brief thoughts on Docker by jtgeibel on Sunday August 04, 2013 @06:48PM (#6157406)

I came across this wiki page last night. It doesn't support this out of the box, but it looks like there is a way to run docker inside of a docker container. It seems to take a good bit of customization though.

https://github.com/dotcloud/docker/wiki/Docker-in-Docker

[ Parent | on HN ]

Re:Brief thoughts on Docker by kstaken on Monday August 05, 2013 @12:19AM (#6158443)

Docker will be changing to just listen on a unix domain socket by default.

[ Parent | on HN ]