11

I just noticed I'm rather eager to test projects that have a Docker container bundled with them. I do realize that setting a sudoers exception for the "docker" command basically means giving root access on the host system to regular users. Is running random "docker pull" insecure as well or can I assume that the containers downloaded this way will not easily get root access to my Linux host?

Improve this question

1 Answer 1

Reset to default
3

Welllll.... The simple answer is 'no'. docker pull must execute with elevated privileges, but that does not grant those rights to other users. The kicker is "What comes next?" If you are not allowing other users the right to run docker (such as creating a docker group with lots of users or generic users) than the risk is only a question of avoiding dodgy containers by only sourcing from reliable sites.

The real question is, "Why are you using docker?" If it is just to manage images and build environments, the tool can be used with very little risk. The closer you get to letting regular users run these system administrative functions, the more risk you undertake.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .