Is it safe to use Python's secrets module in a fresh docker container?

Question

If I create a new Docker container based on a recent Debian image, and if use this container to generate a cryptographic key using Python's secrets module, then is that key safe to use?

My understanding is that the secrets module is based on random.SystemRandom, which in turn relies on os.urandom. Its documentation states:

On Linux, if the getrandom() syscall is available, it is used in blocking mode: block until the system urandom entropy pool is initialized (128 bits of entropy are collected by the kernel). See the PEP 524 for the rationale. On Linux, the getrandom() function can be used to get random bytes in non-blocking mode (using the GRND_NONBLOCK flag) or to poll until the system urandom entropy pool is initialized.

I have no idea how to check whether or not the getrandom() syscall is available. And even if it is, can I trust the entropy pool on a Docker container, since it has less sources of entropy than a regular machine?

Edit: I forgot to mention that my host OS is MacOS 12.6.

Answer 1

The first thing to mention here is that Docker containers (from the host's perspective) are just ordinary processes, they use the same kernal as any other program running on the host.

There are some layers of isolation in typical container setups and one of these will block some syscalls from inside containers, if you're running in Docker.

There's a list of the blocked syscalls here but I don't see any mention of getrandom, so I'd expect it should work fine.