2

If I create a new Docker container based on a recent Debian image, and if use this container to generate a cryptographic key using Python's secrets module, then is that key safe to use?

My understanding is that the secrets module is based on random.SystemRandom, which in turn relies on os.urandom. Its documentation states:

On Linux, if the getrandom() syscall is available, it is used in blocking mode: block until the system urandom entropy pool is initialized (128 bits of entropy are collected by the kernel). See the PEP 524 for the rationale. On Linux, the getrandom() function can be used to get random bytes in non-blocking mode (using the GRND_NONBLOCK flag) or to poll until the system urandom entropy pool is initialized.

I have no idea how to check whether or not the getrandom() syscall is available. And even if it is, can I trust the entropy pool on a Docker container, since it has less sources of entropy than a regular machine?

Edit: I forgot to mention that my host OS is MacOS 12.6.

1 Answer 1

2

The first thing to mention here is that Docker containers (from the host's perspective) are just ordinary processes, they use the same kernal as any other program running on the host.

There are some layers of isolation in typical container setups and one of these will block some syscalls from inside containers, if you're running in Docker.

There's a list of the blocked syscalls here but I don't see any mention of getrandom, so I'd expect it should work fine.

2
  • Thanks @rory-mccune, that's good news. I forgot to mention that my host OS is MacOS, I'm not sure whether this makes a difference?
    – MiniQuark
    Nov 13, 2022 at 21:04
  • 1
    So if you're using MacOS, what's happening under the covers (assuming you're using Docker Desktop) is that there's a Linux VM present that Docker manages for you. The syscall situation should be the same as with Docker straight onto Linux, as the containers are being run on that VM. Nov 14, 2022 at 7:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .