One Command Gives Any User Root on Linux with Docker
Be Using Rootless Containers
Docker's root-owned daemon means that adding your user to the docker group for convenience opens a trivial root escalation path. A single docker run can mount the host filesystem and read protected files without a password. Rootless alternatives like Podman run containers under your own user, closing the hole, though they come with trade-offs around image naming, daemonless restarts, and API access.
Because the container is running under the root account through the Docker daemon, it has access to all files and thus can bypass any restrictions of the user that issued the docker run command.
- ma2kx
In my opinion the biggest advantage of podman is that it uses pods with basically the same config and behavior as kubernetes does. As long as you just use podman pods instead (or possibly via) compose files you likely just notice that only the pod has one (and not any more) veth interface, that you reach other containers inside a pod via localhost:$port (instead of $service-name:$port) but when you switch later on to kubernetes you are already familiar with some basics.
- orangea
Why would an adversary being able to execute code as root on a personal computer be a bigger threat than their being able to execute code as non-root? Surely just about any of the stuff that a malicious hacker might want to do to someone's personal computer can be done without root... right?
- venussnatch
>the one led by the racist, so it isn't getting a mention here
Are people really terminally online enough to understand this?