- cross-posted to:
- programmerhumor@lemmy.ml
- cross-posted to:
- programmerhumor@lemmy.ml
You must log in or register to comment.
Never ever add any users to the
dockergroup. Rootless mode is cool tho (albeit with some caveats)Is that normal config?
Slowly reaches for shotgun…
I mean, there’s a big ol’ warning in the docs: https://docs.docker.com/engine/install/linux-postinstall/
The docker group grants root-level privileges to the user
But, I guess Docker doesn’t really tell you not to do this… and I feel like a lot of mac users are not used to adding sudo at the front of docker commands so… idk.
… and the Nextcloud developers think it’s completely reasonable to build a plugin system where you give this access to a web facing PHP application.
Sadly, nobody reads docs anymore. Now that I’m thinking, people never read the docs.
Sounds like Docker is just inherently unsecure.
In the same way that sudo is.
Sudo makes you enter your password and docker doesn’t?
Docker does by default - it only works if you use sudo. But the docs tell you to add yourself to the docker group (which requires sudo to do). Then running docker doesn’t require sudo anymore.
Yeah, that’s a terrible decision in the docs. Don’t ever add a path where anything on the shell can execute user-modifyable code as root.
As soon as you do that, you lose any protection that comes from separating root users and non-root users. Because now any malicious program can just use docker to elevate its code to root.
Or don’t give your user docker and use sudo to use the docker CLI to get the same effect. Hell, you could even alias docker as
sudo dockerto get the same feel.Only if you tell it to.
Podman will save us from the Terminators.
I remember when I first needed to run containers I specifically went with podman because it doesn’t require root access out of some vague fear that docker can be exploited to break my stuff. I feel validated.
