On: Threat Actors Now Target Docker via Container Esca...

[trynton]

"A malicious container running on a Docker-run host is deployed and ran"

A most relevant question being, how does this "malicious container" get onto the host in the first place?

[rodgerd → trynton]

You might be surprised by the number of developers who get really upset if their workplace doesn't allow "pull random containers off the Internet" as part of their workflow.

[piaste → rodgerd]

Well if you don't want to let devs run arbitrary code off the internet on their machines, that cuts off more than Docker Hub, it cuts off almost every package manager under the sun.

If I had to work under such a restriction, I would ask for a cheap spare machine, running on a guest network and hosting no sensitive code, where I could download and try random packages off the internet before I could submit them for audit, approval and vendoring.

[orra → trynton]

Cloud hosting... if you're on the same physical node as a malicious actor, then ouch.

[ta988 → orra]

Did you ever see cloud hosting where you can run privileged containers on a shared machine?

[orra → ta988]

Privileged? Maybe not. But in general, Docker is not a security boundary, but people treat it like one.

[krab → orra]

The services I have experience with host containers on a VM that is not shared between customers.

[orra → krab]

That's good. But I don't think the major cloud providers make it very obviously, either way. And when something's not clear, often the answer isn't good.