I've seen plenty of ink spilled by now about how Docker is not sufficiently isolated to allow arbitrary containers to be run in a multi-tenant environment, and that makes sense. "If it's root in Docker, consider it root in the host machine." What about non-root though?

If I want to take some untrusted code and run it in a container, can it be done safely so long as the container is running as a non-root non-sudo user? What are the potential security pitfalls of doing something like that?

I'm fairly sure there are production applications doing this today (CI systems, runnable pastebins), but are they just lucky not to have had a determined attacker or is this a reasonable thing to do in a production system?

  • 2
    I was under the impression that the docker daemon always runs as the root user, so that's not possible. – drewbenn Aug 27 '15 at 23:50
  • I'm talking about inside the container either having the Dockerfile run the process as a non-root user with USER or running a script before untrusted code is executed that changes to a non-root user. – Michael Bleigh Aug 28 '15 at 20:54
  • relevant: lwn.net/Articles/646330 (i.e.: the answer depends on how actively you manage your containers) – drewbenn Aug 28 '15 at 21:29

Docker and LXC technology itself is still in very early stages when it comes to exploitation testing. drewbenn is right in highlighting the difficulties of running Docker containers as a non root user - there are inherently some very low level things that need to happen in order to start up an LXC container.

Something interesting to consider though is the intended target any malware that you're trying to isolate in the container.

Say the malware was trying to exploit a flaw in a piece of local software to do privilege escalation. It might achieve that inside the container, but then it would also have to have been written specifically to attempt to break out of docker containers to do something malicious.

So the question is - will the people who are writing this untrusted code know that you're going to be running it inside a container? If they do (or if they suspect you will) there's a much higher likelyhood of a vulnerability turning up that exploits a dockerised environment directly.

  • 1
    will the people who are writing this untrusted code know that you're going to be running it inside a container? That's security by obscurity - you shouldn't rely on that. – mgarciaisaia Dec 30 '16 at 2:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.