1

I manage a multi-user workstation (Windows) server for a small student organisation. One of the students asked me to install docker, as it would simplify his workflow. As this is on a shared workstation, I'm concerned about security. On linux, if you have access to docker, you effectively have root permissions. I am aware that docker on windows has two backends; WSL2 and Hyper-V. I am considering the latter as the OS is Windows Server 2019 (no WSL2) and we have already several VMs. I will probably upgrade to 2021 in a few months after it is available.

I have read, that docker for desktop is by defult for admins only, but I could not find a reason why that is. I intend to create a docker group and allow only specific non-admin users. I assume that any program breaking out of docker inside the VM has no access to the host OS itself. My next assuption is that Windows permissions are enforced when mounting/sharing a folder to a docker container.

Is it secure/good idea to allow docker in this environment?

1

Allowing unrestricted Docker commands on a host from (relatively) untrusted users is likely to be a cause of problems, as it allows for access to the underlying host OS.

One example is file mounts. Using Hyper-V Windows containers, the user on the host used to check for permissions is LocalSystem , so any directory that user has access to can be mounted inside a container (more info. on windows container permissions here

It's also possible to get access to hardware from Docker in Windows, based on the docs here.

One option might be (assuming your users want to run Linux containers) to create a Linux VM for the user manually on your Windows host, and then provide them with access to Docker running in that VM, either by given them SSH access to the VM, or by putting the Docker client on the host machine and connecting over SSH

1
  • Yes, I forgot to mention the containers would be on linux. What about WSL2? I have played with it for a bit and it seems that "docker proxy" process and dllhost (which accesses the files) is running as logged in windows user, even windows folder permissions are respected – trogper Apr 5 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.