Docker creates a virtual Linux environment basically, they mean they would like the user in that environment to not be root. I can submit a MR later today to do so (I authored the automatic docker builds MR)
A quick google tells me there were 3 vulns in 2022 allowing it. I’m not sure why you would argue for a horrible security practice under the excuse “it’s not common”. Even if it was only once every few years, the app doesn’t need root so it shouldn’t run as root.
I’m not advocating for running containers as root, I was correcting your suggestion that container breakouts are trivial and easy to perform. But let’s walk through those 2022 breakout vulns shall we? I even found one more.
CVE-2022-0847 - DirtyPipe, a Linux kernel vulnerability, and one of the most major and prolific Linux kernel vulns to date. In addition, it wouldn’t have mattered if the container ran as root or not, this was a significant Linux kernel flaw. In fact, the PoC runs the container as an unprivileged user.
CVE-2022-0492 - Needed CAP_SYS_ADMIN to be exploitable, isn’t exploitable anymore, and falls under my remark of “the user doing something stupid.”
CVE-2022-0492 - Vulnerability due to cgroups, and wouldn’t be exploitable as a root container user unless a very specific set of 5 prerequisites were met. “Just being root” was not enough for exploitation.
CVE-2022-23648 - Was a read-only vulnerability relating to volume mounts, root vs non-root was not relevant to the vulnerability, and it only allowed for “breakout” in situations where you’re running in a Kubernetes cluster and the container can read service account tokens. Running as a non root user would not have prevented this.
I’m not saying “running as root doesn’t matter,” running as a non root user is a best practice, yes. But breakout vulns are more rare and harder to exploit than even your response to me is trying suggest.
photon.xylight.dev
Active