I feel like I read the exact same story (Person discovers docker group is effectively root because llm agent used it to circumvent not having sudo) a few minths ago.
(Not saying you stole it, two people can have the same experience independently of each other. I just found it interesting that this is, apperently, such a commonly overlooked issue.)
Also, this is documented:
Running containers (and applications) with Docker implies running the Docker daemon. This daemon requires root privileges unless you opt-in to Rootless mode, and you should therefore be aware of some important details.
First of all, only trusted users should be allowed to control your Docker daemon. This is a direct consequence of some powerful Docker features. Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container. This means that you can start a container where the /host directory is the / directory on your host; and the container can alter your host filesystem without any restriction. This is similar to how virtualization systems allow filesystem resource sharing. Nothing prevents you from sharing your root filesystem (or even your root block device) with a virtual machine.
Yeah, I think of myself as fairly security conscious, not an expert but interested layman. And I still didn’t realize it for so many years so I figured many other people probably also didn’t, therefor I posted it.
Also back in around 2018 I was setting up docker to contain bitbake in a ubuntu container to be able to run it on my Arch, because everyone else was running debian or ubuntu at work and nobody wanted to deal with my Arch installation. But I wanted a nice seamless way of doing by mounting the current directory and aliasing bitbake to docker exec -it ... and doing sudo every time felt kind of wrong so I read in the documentation about adding my user to the docker group and didn’t really think about it since then until now.
Super fair, ich habe erst die letzten Jahre angefangen mich mehr mit Containern auseinander zu setzen und da war diese Gefahr in vielen Tutorials recht präsent. ist wahrscheinlich ein shift der da in der Wahrnehung zwischenzeitlich passiert ist.
I feel like I read the exact same story (Person discovers docker group is effectively root because llm agent used it to circumvent not having sudo) a few minths ago. (Not saying you stole it, two people can have the same experience independently of each other. I just found it interesting that this is, apperently, such a commonly overlooked issue.)
Also, this is documented:
https://docs.docker.com/engine/security/#docker-daemon-attack-surface
Yeah, I think of myself as fairly security conscious, not an expert but interested layman. And I still didn’t realize it for so many years so I figured many other people probably also didn’t, therefor I posted it.
Also back in around 2018 I was setting up docker to contain bitbake in a ubuntu container to be able to run it on my Arch, because everyone else was running debian or ubuntu at work and nobody wanted to deal with my Arch installation. But I wanted a nice seamless way of doing by mounting the current directory and aliasing bitbake to
docker exec -it ...and doing sudo every time felt kind of wrong so I read in the documentation about adding my user to the docker group and didn’t really think about it since then until now.Super fair, ich habe erst die letzten Jahre angefangen mich mehr mit Containern auseinander zu setzen und da war diese Gefahr in vielen Tutorials recht präsent. ist wahrscheinlich ein shift der da in der Wahrnehung zwischenzeitlich passiert ist.