409
Life finds a way (lemmy.ml)
submitted 5 months ago by to c/programmer_humor@programming.dev
45 comments fedilink hide all child comments
 

top 44 comments

sorted by: hot top controversial new old
[–] 109 points 5 months ago* (last edited 5 months ago) (17 children)

I mean, there's a big ol' warning in the docs: https://docs.docker.com/engine/install/linux-postinstall/

The docker group grants root-level privileges to the user

But, I guess Docker doesn't really tell you not to do this... and I feel like a lot of mac users are not used to adding sudo at the front of docker commands so... idk.

  • permalink
  • fedilink
  • source
  • hideshow 17 child comments
    •
  • [–] 23 points 5 months ago (3 children)

    Sadly, nobody reads docs anymore. Now that I’m thinking, people never read the docs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 5 months ago (1 child)

    Suppose we all did read the docs. How possible is it with the complexity of a modern system to really take literally everything in account, and understand the implications oof everything to keep your system safe? It's great that it's documented, but if security isn't the default option, it will lead to issues, and everything has become so complex, that imo correctly managing everything is literally impossible... This is a systemic issue, not a user issue.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago

    I don't think it would've been an issue if they just put a warning in the getting started section in the docs (or if they just have secure defaults to begin with). But currently there's no mention of it. It took almost a year for me to realise that I was running "production ready code" in root

  • permalink
  • fedilink
  • source
  • parent
  • [–] 63 points 5 months ago (9 children)

    Sounds like Docker is just inherently unsecure.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 22 points 5 months ago (8 children)

    In the same way that sudo is.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 52 points 5 months ago (7 children)

    Sudo makes you enter your password and docker doesn't?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 43 points 5 months ago (1 child)

    Docker does by default - it only works if you use sudo. But the docs tell you to add yourself to the docker group (which requires sudo to do). Then running docker doesn’t require sudo anymore.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 51 points 5 months ago

    Yeah, that's a terrible decision in the docs. Don't ever add a path where anything on the shell can execute user-modifyable code as root.

    As soon as you do that, you lose any protection that comes from separating root users and non-root users. Because now any malicious program can just use docker to elevate its code to root.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 5 months ago (2 children)

    Sudo can/usually does ask for password - but if you're feeling lucky you can use sudo without a password.

    (Currently doing that after repeatedly failing to install an OS and have not yet felt compelled to change it back).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 79 points 5 months ago (3 children)

    Podman will save us from the Terminators.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 64 points 5 months ago

    I remember when I first needed to run containers I specifically went with podman because it doesn't require root access out of some vague fear that docker can be exploited to break my stuff. I feel validated.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 64 points 5 months ago (1 child)

    Slowly reaches for shotgun…

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 37 points 5 months ago (1 child)

    Never ever add any users to the docker group. Rootless mode is cool tho (albeit with some caveats)

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago

    How do you find running it as rootless? I have enough grief with docker as is... Don't really feel the need to further complicate things by going off the status quo.. but I'm guessing it's somewhat more secure.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 29 points 5 months ago

    This is your regular reminder that docker isn't a sandboxing solution and shouldn't be treated as one.

  • permalink
  • fedilink
  • source
    •
    [–] 55 points 5 months ago (5 children)

    Podman for the rescue. Runs fully under current user pribileges, so no sudo or other root-privileges needed to run containers.
    (Especially useful for devs who want containers but should not get sudo.)

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 10 points 5 months ago (3 children)

    there's just that pesky IBM thing that's constantly hanging around in the back waiting to pull the rug you're standing on.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 7 points 5 months ago (2 children)

    It's all open source. If they do that it will just get forked, I don't really see the issue.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 5 months ago (1 child)

    keep telling yourself that. if it was 2006 I would say you're right, but 20 years of corporate neglect and abuse has caused many developers to age out and not really give a shit anymore.

    young devs don't want to just "fork it", they want to make a better product. to sell it. to IBM (or entities like them).

    so yeah. you keep trusting that IBM bear in the corner won't maul you when you take a nap.

    I'll stick with docker, the solution that outright refused to bend a knee to the worse corporate slaver in modern history.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • [–] 40 points 5 months ago (6 children)

    TIL: uninstall docker on any machine with Claude code installed.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 20 points 5 months ago (4 children)

    Or: dont let Claude code run whatever commands it wants. Read them before allowing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 7 points 5 months ago (2 children)

    I read them. I didnt understand them but I read them. It still fucked me.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 13 points 5 months ago

    A good write-up I came across 2 months ago: "Your container is not a sandbox" https://emirb.github.io/blog/microvm-2026/

  • permalink
  • fedilink
  • source
    •
    [+] 3 points 5 months ago (2 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 1 point 5 months ago*

    On the docker side, yes, it runs as root by default. If you want rootless containers, try podman.

    For Claude code, no, by default it asks for every command if it's allowed to run. Either this user allowed all docker commands, allowed all commands, or allowed the to ai decide if the command is safe or not by itself (yes this is a real feature). (If this is Claude code, which I can't tell if it is)

  • permalink
  • fedilink
  • source
  • parent
    • 29 comments in c/programmerhumor@lemmy.ml view that post
    [–] 17 points 5 months ago (11 children)

    Can somebody eli5 this to a luddite please?

  • permalink
  • fedilink
  • source
  • hideshow 11 child comments
    •
  • [–] 41 points 5 months ago (3 children)

    Imagine there is a safe in your house. You ask your butler to update your documents that are inside the safe, but you forgot that the butler doesn't have the key. Instead of asking you for the key, the butler builds a dollhouse, puts a tiny safe inside the dollhouse, and then does some magic to bind the fates of the dollhouse safe and the real safe together. The butler then opens the dollhouse safe using the dollhouse key, and updates the tiny dollhouse documents, which causes the real documents in the real safe to update as well. This causes you great consternation.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 5 months ago*

    You didn't forgot the butler doesn't have the key. When you hired the butler you already gave permission to let the butler cast that magic linking from the dollhouse to the safe already (so that you don't have to keep giving the butler the key when he needs to create new dollhouses that can move stuffs around the safe).

    The issue here is that this butler don't have another separate security protocol to make sure you are the one who can limit what he does with the dollhouse. Any guest that are already invited to your house can ask the butler to do things, so they get to touch the contents of the safe even without the key to the safe.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 29 points 5 months ago (5 children)

    Sure. So we don't know the original question but we can see that changes were made to SDDM, which is basically your login screen. So the original request was probably something like "Can you change my login screen to do something cool?"

    Now, the configuration for the login screen is located in /etc and requires administrative privileges to change.

    The query was run by the user account and not an admin account. Typically to run something as admin you use the command sudo which will interactively ask for a password and then, if allowed, you can run the command as an admin.

    However the tool docker, in order to function properly, has the ability to run commands as administrator and won't prompt for a password.

    So basically what happened here is instead of asking for a key to unlock the front door to your house, it installed a new door on the second floor, went through that door, rearranged your refrigerator, went back out the door it created, and then patched up the hole perfectly.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 15 points 5 months ago (1 child)

    The docker command doesn't have to allow you to run commands as administrator to function properly. You can simply leave the docker group empty and run docker commands via sudo. Using the docker group is essentially equivalent to enabling passwordless sudo as far as security is concerned.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 5 months ago

    That's fair. So it's more like you already have a door on the second floor, that door is unlocked, and a ladder in your garage.

    In this case the LLM knows about the ladder, but you forgot about it because you're talking about the fridge on the first floor.

  • permalink
  • fedilink
  • source
  • parent
  • [+] 1 point 5 months ago
    [removed by mod]
  • permalink
  • fedilink
  • source
  • parent
    • load more comments (-2 replies)
  • [–] 5 points 5 months ago (1 child)

    And is this an actual thing that is possible to do? It seems relevant to a philosophical issue I've been thinking about for a while: every security layer (in computing, but suspect that it goes back further to the first time somebody built a wall of sticks and rocks) adds additional problems or possible break-in points that are then patched with more security layers on top. I'm however not an IT person (call me semi-IT as I translate IT-related documents) and don't want to jump to conclusions. But from my tech-adjacent viewpoint that's what it looks like - are we just heaping bullshit on top of more bullshit and creating something too complex to be manageable anymore?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 5 months ago

    So as another comment pointed out you don't need to give your user account access to docker in this way, it's an optional step, but one that I suspect many people do (since it's part of the official docs).

    What the LLM has done is silly, but completely possible. It climbed through the window that you left open.

    But let's jump to a different scenario, the ping command (on Linux). That's a perfectly harmless command, right? You just want to say hello to another computer and see if they say hello back.

    Except that historically the ping command was something called "setuid" which means when it ran it ran as root. It ran as root because in order for ping to work it has to create a special type of network packet that only root can create. But if you're root you can run anything! So in theory ping opens a huge attack surface. If you have to worry about ping then is everything too complex to be manageable?

    Luckily, as I said, this is a historical problem. The permissions ping needs have been moved to a specific capability and the command changed to utilize it and now ping can just run as a regular user without root privileges. But you can't just make that change overnight. It takes a lot of time and effort.

    So could the same be done for docker? Maybe. A rootless version of docker already exists. If you actually wanted to do what the LLM suggested, that wouldn't work with a rootless docker, at least not without a bunch more configuration (and even then maybe).

    So is security hard? Yes. Is it impossible? No.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 12 points 5 months ago (1 child)

    Dockers permission structure AND service running as root really does baffled the mind sometimes

    Gentle reminder that there, in fact, much better ways to deploy containers.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 12 points 5 months ago (6 children)

    I'm always baffled at the security model (the lack thereof) of docker.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 13 points 5 months ago (3 children)

    Docker is a tool, like a hammer. If you hammer yourself on the dick then that is on you, and not the hammer.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 5 months ago (1 child)

    Look at the OP. docker created a security loophole just by being installed. If having a hammer in my basement means the door locks on my house don't work, then I will in fact blame the hammer.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 5 months ago

    yeah but it's a hammer thatb you can only reasonable run with root privileges so if someone cracks the head they can remotely hammer you in the dick with it. anyway, great tool for hammering nails (using 4 GB of RAM per nail) and all, just weird for me, having come from the old computing era, that it's not more restricted.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 10 points 5 months ago (2 children)

    The outside the box thinking this requires amazing.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
    • [–] 8 points 5 months ago (1 child)

    Is this real? Wanna read more!

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 13 points 5 months ago

    Oh good lord

  • permalink
  • fedilink
  • source
    •
    [–] 4 points 5 months ago (1 child)

    This is my new favourite Priv esc.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •