I said it’s not a Docker problem in the same way that installing a malware-laden executable isn’t an OS problem. Yes, you can install malware through Docker if you opt-in, the trick is to not opt-in. Check where they’re coming from, look at multiple examples online and see if they’re all using the same image, etc. Do your due diligence, especially if you’re not a developer and thus looking at the Dockerfiles is impractical.
But unless there’s an actual vulnerability in Docker (i.e. exploit in the daemon, credential breach of Docker hub, etc), the finger should be pointed elsewhere. Maybe that’s the kernel (i.e. breaking out of the sandbox), but it’s likely blog posts and users that are at fault.
I looked through those links, and here are my thoughts:
- Yes, Docker vulnerabilities are a problem, but an attacker would need to trigger the vulnerability and break out of the sandbox, so it’s not as serious imo; users should stay up to date though, especially if they’re using a popular base image
- This comes down to user configuration; if you confine a volume properly, it shouldn’t be an issue.
- This is really bad, and it’s heartening to see Docker take it seriously. A breach is by far my biggest concern when it comes to hosted services like this.
- I’ll need to find a follow-up to see how Docker handles account deletions, because if names can be reused, that’s ripe for exploits.
Yes, there are plenty of opportunities for exploits in the Docker ecosystem, but I think the risk is pretty low given Docker has it’s own sandbox, which adds a layer of complexity to exploits. The focus shouldn’t necessarily be on something Docker should be doing, but teaching users how to configure containers properly. That means:
- one process per container - nudges users to configure things properly, which reduces risk (limit access to data, executables, etc)
- rebuild frequently - using more general names (e.g. python:3.10) instead of specific names (python:3.10.3) means you’re more likely to get security updates when you rebuild; this also means scans targeting big repos are more effective since that’s just one org to contact
- do regular backups - ransomware attacks should be a complete non-issue, and other malware attacks should be reasonably easy to recover from
No platform is perfect, and practicing the above is probably easier than implementing non-root containers, and non-root itself isn’t a cure-all. Do the above first, and then consider non-root containers in production.
in the same way that installing a malware-laden executable isn’t an OS problem
except no one is doing that. Every major distro hast mechanisms for software supply chain security and reproducible builds.
Do your due diligence, especially if you’re not a developer and thus looking at the Dockerfiles is impractical.
You’re on to something here. If you automate that process, you end up with something we call a package manager.
it’s likely blog posts and users that are at fault.
Exactly. And sincer reviewing Dockerfiles is impractical, there’s no way docker prevents you from shooting your own foot. Distros learned that long ago: Insecure default configs or injected dependencies are a thing of the past there. With docker, those get reintroduced.
except no one is doing that
Given the number of posts I’ve seen online and adding PPAs or RPM repos, or installing things from source, I’d say that number is a lot higher than 0.
Docker contains that nonsense in a way that’s easy to update. And it allows developers to test production dependencies on a system without those production libs.
something we call a package manager.
Package managers don’t provide a sandbox. You can get one with SELinux, but that requires proper configuration, and then we’re back to the original issue.
Docker provides a decent default configuration. So I think the average user who doesn’t run updates consistently, may add sketchy dependencies, and doesn’t audit things would be better off with Docker.
So yeah, you may have more vulnerabilities with Docker, but they’re less likely to cause widespread issues since each is in its own sandbox. And due to the way its designed, it’s often easier to do things “the right way” (separate concerns) than the wrong way (relax security until it works).
adding PPAs or RPM repos, or installing things from source, I’d say that number is a lot higher than 0.
Nothing wrong with that. Unlike docker that’s cryptographically protected toolchain/buildchain/depchain. Thus, a PPA owner is much less likely to get compromised.
Installing things from source in a secure environment is about as safe as you can get, when obtaining the source securely.
Docker contains that nonsense in a way that’s easy to update.
Really? Ist there already a builtin way to update all installed docker containers?
What’s uneasy about apt full-upgrade?
Package managers don’t provide a sandbox.
I didn’t say that.
average user who doesn’t run updates consistently, may add sketchy dependencies, and doesn’t audit things would be better off with Docker.
That’s false.
but they’re less likely to cause widespread issues since each is in its own sandbox.
Also false. Sandbox evasion is very easy and the next local PE kernel vulnerability only weeks away. Also VM evasion is a thing.
Basically one compromised container giving local execution is enough to pwn your complete host.
