I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is essentially parameterizing the ffmpeg command.
I'm planning to run ffmpeg in a dockerized environment, possibly with a new docker container per execution. Regardless, this environment could be used to execute arbitrary code and might have have access to some of my secrets.
Beyond command-line injection, are there any other security concerns to consider here?
An update on my situation. I am running ffmpeg inside a docker container with networking disabled and passing the input and output files via a shared directory.
The command below does the following:
- Puts the input file into a shared directory with the container
- Runs FFMPEG inside the container with whatever options are passed
- Puts the output file into the host shared directory, where the host will then copy it to it's final storage location
docker run -v <TEMP_DIR_ON_HOST>:/temp/ --network none \ jrottenberg/ffmpeg -stats \ -i /temp/<INPUT_FILE> \ <FFMPEG_OPTIONS> \ /temp/<OUTPUT_FILE>
A few notes:
- TEMP_DIR_ON_HOST is a single use directory for one conversion
- FFMPEG_OPTIONS are scrubbed, but could potentially contain injection
- I'm not locked into the jrottenberg/ffmpeg image, I might make a copy or at least lock down to a particular version.
I think that disabling networking and limiting outside file access greatly reduces the risk even if malicious commands are injected somehow. Are there any major risks beyond wasted resources?