Hacker News Reader

Comment by weinzierl | Hacker News Reader

Before you use no sandbox at all use this or one the many similar projects but it's alway worth remembering that Docker is not a security boundary. It never has been meant to be and never will become one.

cgroups are a mechanism designed for hierarchical organization and resource distribution. Against a malicious and capable actor, and that is how we have to treat AI agents, cgroups will not withstand.

Also, the kernal is an interface too big for what an AI agent needs and is therefore offering a gigantic attack surface completely unnecessarily.

View on HN

Which is fine but this thread is about a feature that provides hypervisor isolation, not cgroups.

Would you say podman is better, or is it the same as docker ?

In general running containers rootless is better from a security standpoint and podman makes this much easier. So, yes.

This is not my main point though. Both are based on cgroups and cgroups are the wrong tool for the job.

Wouldn't it need a super critical exploit, I mean zero-day vulnerability, to escape from that kind of sandbox ? And if you think further, then isn't that risk also applicable to pretty much any kind of sandboxing ?

Container escapes are more common than you think. Common enough for AWS not to rely on containers for their serverless functions, common enough for Google to say: "Untrusted code shouldn't rely on the container security boundary [..]" [1]

The same is not applicable for any kind of sandboxing for two reasons:

1. The boundary is in the kernal’s own code, enforced by the thing you are trying to be protected from. -> Use a VM

2. The kernal is a gigantic attack surface -> Use gVisor

[1] https://docs.cloud.google.com/kubernetes-engine/docs/resourc...

What if you use tools like bubblewrap or nono inside the container?

Say I want to use pi inside a container. If I wrap pi within a bubblewrap or within nono, how is that less secure than using a vm?

Also, I think most people run containers inside VMs anyway and not directly on their hosts (on Mac and windows you have to use a vm anyway).

bubble wrap is just doing the same cgroups work

Depending on the configuration, bubblewrap can substantially reduce the attack surface.

It doesn’t change the fact a malicious process is still attacking the same kernel , but it can reduce what it can do to that vm.

As the sibling said, Docker Sandbox is not based on standard Docker containers. It spawns micro VMs.

Reply on news.ycombinator.com