Comment

Comment by tln

Not sure about production workloads but its not just privileged containers you start that should be a concern.. anyone who can access /var/run/docker.sock can run a privileged container, so this can be a privilege escalation.

Because of this escape, giving access to /var/run/docker.sock to regular users is the same as giving them root access.

Also as the article says mounting /var/run/docker.sock is (now, because of this escape) the same as giving that container access to the host system.

parent tln 7 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton