409
Life finds a way (lemmy.ml)
submitted 5 months ago by to c/programmer_humor@programming.dev
45 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 109 points 5 months ago* (last edited 5 months ago) (17 children)

I mean, there's a big ol' warning in the docs: https://docs.docker.com/engine/install/linux-postinstall/

The docker group grants root-level privileges to the user

But, I guess Docker doesn't really tell you not to do this... and I feel like a lot of mac users are not used to adding sudo at the front of docker commands so... idk.

  • permalink
  • fedilink
  • source
  • hideshow 17 child comments
    •
  • [–] 23 points 5 months ago (3 children)

    Sadly, nobody reads docs anymore. Now that I’m thinking, people never read the docs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 5 months ago (1 child)

    Suppose we all did read the docs. How possible is it with the complexity of a modern system to really take literally everything in account, and understand the implications oof everything to keep your system safe? It's great that it's documented, but if security isn't the default option, it will lead to issues, and everything has become so complex, that imo correctly managing everything is literally impossible... This is a systemic issue, not a user issue.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago

    I don't think it would've been an issue if they just put a warning in the getting started section in the docs (or if they just have secure defaults to begin with). But currently there's no mention of it. It took almost a year for me to realise that I was running "production ready code" in root

  • permalink
  • fedilink
  • source
  • parent
  • [–] 63 points 5 months ago (9 children)

    Sounds like Docker is just inherently unsecure.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 22 points 5 months ago (8 children)

    In the same way that sudo is.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 52 points 5 months ago (7 children)

    Sudo makes you enter your password and docker doesn't?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 43 points 5 months ago (1 child)

    Docker does by default - it only works if you use sudo. But the docs tell you to add yourself to the docker group (which requires sudo to do). Then running docker doesn’t require sudo anymore.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 51 points 5 months ago

    Yeah, that's a terrible decision in the docs. Don't ever add a path where anything on the shell can execute user-modifyable code as root.

    As soon as you do that, you lose any protection that comes from separating root users and non-root users. Because now any malicious program can just use docker to elevate its code to root.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 5 months ago (2 children)

    Sudo can/usually does ask for password - but if you're feeling lucky you can use sudo without a password.

    (Currently doing that after repeatedly failing to install an OS and have not yet felt compelled to change it back).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •