Hacker News Reader

Comment by Jonnax | Hacker News Reader

Is the Docker daemon actually a huge security hole?

I see people championing Podman because it's daemonless but is it actually beneficial or is it championed because it's Red Hat and a case of security check boxing?

View on HN

It's a root daemon which can be made to run arbitrary commands by anyone using its interface, so yes it is a huge, huge security burden. You can't just brush that off as a superficial problem.

Given that the most common case is running docker in server environments in VMs and the sysadmins are root, is this a real issue? Can you tell me an environment where a multi-tenant system runs docker?

Yes, it[1] is[2] a[3] real[4] issue[5] which leads to privilege escalation bugs. It also doesn't help that most containers that Docker is responsible for managing is supposed to be unprivileged, and Docker itself is commonly used as a component for a multi-tenant container runtime.

[1] https://www.cvedetails.com/cve/CVE-2019-15752/

[2] https://www.cvedetails.com/cve/CVE-2019-14271/

[3] https://www.cvedetails.com/cve/CVE-2019-5736/

[4] https://www.cvedetails.com/cve/CVE-2018-15664/

[5] https://www.cvedetails.com/cve/CVE-2018-15514/

It certainly is a gaping hole. But the machines that docker runs on in my experience have a 100% sudoers ratio, so the practical impact is limited.

Do you mean in that adding a user to the docker group is effectively handing them root? Because if you don't do that, then running docker requires root/sudo, which means that it should be exactly as secure as anything else

> Is the Docker daemon actually a huge security hole?

Yes.

Also the containers on docker hub are a security dumpster fire.

Reply on news.ycombinator.com