• Dandroid
    link
    fedilink
    English
    121 year ago

    Don’t let perfection be the enemy of good. Security is not all or nothing. Reducing the attack surface is still important.

    Can you elaborate on running docker daemon as rootless? It’s my understanding that you can add your account to a group to access the docker daemon rootless, but the containers are still running as root, as the daemon itself raises the access to root.

    • icedterminal
      link
      English
      21 year ago

      but the containers are still running as root, as the daemon itself raises the access to root.

      No. The daemon can run without root, as such the containers don’t have root. My docker install doesn’t have root access. None of my stacks / containers need any root access tbh. I don’t have any troubles with deplyong stuff.

      https://docs.docker.com/engine/security/rootless/

    • @[email protected]
      link
      fedilink
      English
      -41 year ago

      Not sure relying on podman alone as a security tool might be advisable. Podman is a container technology first, security is not the main goal.

      Read more about rootless docker here.

      • Dandroid
        link
        fedilink
        English
        71 year ago

        I never said I was relying on it alone. Not sure why you think that.

        That’s a great link. Thank you for sharing. It’s good that docker supports this functionality now.

        • @[email protected]
          link
          fedilink
          English
          -51 year ago

          I never said I was relying on it alone. Not sure why you think that.

          …all my services aren’t running as root.

          If it turns out a vulnerability is discovered in lemmy tomorrow that allows people to access my server through my lemmy container, the attacker will only have access to a dummy account that hosts my containers.

          This was your argument according to you for why you think podman is more secure (than docker I presume). Seemed to imply rootless podman will save you from an attacker. I was simply disproving the flawed notion.

          • @[email protected]
            link
            fedilink
            English
            01 year ago

            I think you’re interpreting too much. Security is about layers and making it harder for attackers, and that’s exactly what using a non-root user does.

            In that scenario, the attacker needs to find and exploit another vulnerability to gain root access, which takes time - time which the attacker might not be willing to spend and time which you can use to respond.

            • @[email protected]
              link
              fedilink
              English
              -31 year ago

              You don’t know enough about security to lecture me. The kernel has before/continues to suffer(ed) from successful root shell exploits, particularly in this case via unprivileged userns. Something podman or even rootless docker can’t do anything about.

              • @[email protected]
                link
                fedilink
                English
                -11 year ago

                Funny how you claim to know so much about security but can’t even seem to comprehend my comment. I know root shell exploits exist, that’s why I wrote that it takes additional time to get root access, not that it’s impossible. And that’s still a security improvement because it’s an additional hurdle for the adversary.

                • apigban
                  link
                  fedilink
                  English
                  21 year ago

                  the person you are replying to either lacks comprehension or maybe just wants to be argumentative and doesn’t want to comprehend.

                • @[email protected]
                  link
                  fedilink
                  English
                  -31 year ago

                  Containers cannot be viewed as security tools. They suffer from poor isolation and inadequate and some cases non-existent sandboxing. All these are proven security essentials. You would know about them if you knew anything about (defensive) security!

                  • @[email protected]
                    link
                    fedilink
                    English
                    11 year ago

                    Once again, you’re going off on an unrelated tangent. If you don’t want to listen, I can’t help you. We’re done here.