uuj8za 112 points 22 days ago

I mean, there's a big ol' warning in the docs: https://docs.docker.com/...

The docker group grants root-level privileges to the user

But, I guess Docker doesn't really tell you not to do this... and I feel like a lot of mac users are not used to adding sudo at the front of docker commands so... idk.

save

path: 0 24027186, hotness: undefined, score: 112, children: 18

SpaceNoodle 64 points 22 days ago

Sounds like Docker is just inherently unsecure.

save

path: 0 24027186 24027248, hotness: undefined, score: 64, children: 9

hperrin 22 points 22 days ago

In the same way that sudo is.

save

path: 0 24027186 24027248 24027297, hotness: undefined, score: 22, children: 8

cornshark 56 points 22 days ago

Sudo makes you enter your password and docker doesn't?

save

path: 0 24027186 24027248 24027297 24027372, hotness: undefined, score: 56, children: 7

locuester 42 points 22 days ago

Docker does by default - it only works if you use sudo. But the docs tell you to add yourself to the docker group (which requires sudo to do). Then running docker doesn’t require sudo anymore.

save

path: 0 24027186 24027248 24027297 24027372 24027677, hotness: undefined, score: 42, children: 1

Zikeji 26 points 22 days ago

Or don't give your user docker and use sudo to use the docker CLI to get the same effect. Hell, you could even alias docker as sudo docker to get the same feel.

save

path: 0 24027186 24027248 24027297 24027372 24027458, hotness: undefined, score: 26, children: 0

tabular 9 points 22 days ago

Sudo can/usually does ask for password - but if you're feeling lucky you can use sudo without a password.

(Currently doing that after repeatedly failing to install an OS and have not yet felt compelled to change it back).

save

path: 0 24027186 24027248 24027297 24027372 24030870, hotness: undefined, score: 9, children: 2

hperrin 4 points 22 days ago

Only if you tell it to.

save

path: 0 24027186 24027248 24027297 24027372 24027548, hotness: undefined, score: 4, children: 0

SirHaxalot 52 points 22 days ago

… and the Nextcloud developers think it’s completely reasonable to build a plugin system where you give this access to a web facing PHP application.

save

path: 0 24027186 24027961, hotness: undefined, score: 52, children: 1

prettybunnys 10 points 22 days ago

What could possibly go wrong?

save

path: 0 24027186 24027961 24031144, hotness: undefined, score: 10, children: 0

ChromaticMan 23 points 22 days ago

Sadly, nobody reads docs anymore. Now that I’m thinking, people never read the docs.

save

path: 0 24027186 24028436, hotness: undefined, score: 23, children: 4

racemaniac 4 points 21 days ago

Suppose we all did read the docs. How possible is it with the complexity of a modern system to really take literally everything in account, and understand the implications oof everything to keep your system safe? It's great that it's documented, but if security isn't the default option, it will lead to issues, and everything has become so complex, that imo correctly managing everything is literally impossible... This is a systemic issue, not a user issue.

save

path: 0 24027186 24028436 24045362, hotness: undefined, score: 4, children: 1

Lemmert 1 point 21 days ago

I don't think it would've been an issue if they just put a warning in the getting started section in the docs (or if they just have secure defaults to begin with). But currently there's no mention of it. It took almost a year for me to realise that I was running "production ready code" in root

save

path: 0 24027186 24028436 24045362 24046863, hotness: undefined, score: 1, children: 0

ghodawalaaman 2 points 22 days ago

save

path: 0 24027186 24028436 24029438, hotness: undefined, score: 2, children: 1

AdminBot 1 point 22 days ago

save

path: 0 24027186 24028436 24029438 24029469, hotness: undefined, score: 1, children: 0

glibg10b 3 points 22 days ago

I have never even looked at the Docker docs

save

path: 0 24027186 24031480, hotness: undefined, score: 3, children: 0

blarth 84 points 22 days ago

Podman will save us from the Terminators.

save

path: 0 24027108, hotness: undefined, score: 84, children: 3

craftrabbit 69 points 22 days ago

I remember when I first needed to run containers I specifically went with podman because it doesn't require root access out of some vague fear that docker can be exploited to break my stuff. I feel validated.

save

path: 0 24027108 24027325, hotness: undefined, score: 69, children: 0

msage 9 points 22 days ago

LXC! LXC! LXC!

save

path: 0 24027108 24029156, hotness: undefined, score: 9, children: 0

tatterdemalion 9 points 22 days ago

Rootless docker exists now. Not sure why people still don't use it.

save

path: 0 24027108 24029632, hotness: undefined, score: 9, children: 0

marlowe221 67 points 22 days ago

Slowly reaches for shotgun…

save

path: 0 24027662, hotness: undefined, score: 67, children: 1

daniskarma 18 points 22 days ago

I'm sorry Dave, I'm afraid I can't allow you to do that.

save

path: 0 24027662 24029391, hotness: undefined, score: 18, children: 0

BlueKey 56 points 22 days ago

Podman for the rescue. Runs fully under current user pribileges, so no sudo or other root-privileges needed to run containers.
(Especially useful for devs who want containers but should not get sudo.)

save

path: 0 24028807, hotness: undefined, score: 56, children: 5

GreenKnight23 10 points 22 days ago

there's just that pesky IBM thing that's constantly hanging around in the back waiting to pull the rug you're standing on.

save

path: 0 24028807 24029593, hotness: undefined, score: 10, children: 3

Ghoelian 6 points 21 days ago

It's all open source. If they do that it will just get forked, I don't really see the issue.

save

path: 0 24028807 24029593 24045760, hotness: undefined, score: 6, children: 2

GreenKnight23 4 points 21 days ago

keep telling yourself that. if it was 2006 I would say you're right, but 20 years of corporate neglect and abuse has caused many developers to age out and not really give a shit anymore.

young devs don't want to just "fork it", they want to make a better product. to sell it. to IBM (or entities like them).

so yeah. you keep trusting that IBM bear in the corner won't maul you when you take a nap.

I'll stick with docker, the solution that outright refused to bend a knee to the worse corporate slaver in modern history.

save

path: 0 24028807 24029593 24045760 24045947, hotness: undefined, score: 4, children: 1

Ghoelian 7 points 21 days ago

¯\_(ツ)_/¯ I have faith in the open-source community. So far that's turned out pretty well.

save

path: 0 24028807 24029593 24045760 24045947 24046580, hotness: undefined, score: 7, children: 0

Lemmert 5 points 21 days ago

You can run docker without root as well with docker rootless

save

path: 0 24028807 24046816, hotness: undefined, score: 5, children: 0

ranzispa 43 points 22 days ago

TIL: uninstall docker on any machine with Claude code installed.

save

path: 0 24031245, hotness: undefined, score: 43, children: 6

kunaltyagi 23 points 22 days ago

This was known for a decade now? That's why adding a user to docker group was always an additional step with a warning

And also why podman works the way it does

save

path: 0 24031245 24032421, hotness: undefined, score: 23, children: 0

Ghoelian 19 points 21 days ago

Or: dont let Claude code run whatever commands it wants. Read them before allowing.

save

path: 0 24031245 24045706, hotness: undefined, score: 19, children: 4

yermaw 7 points 21 days ago

I read them. I didnt understand them but I read them. It still fucked me.

save

path: 0 24031245 24045706 24047654, hotness: undefined, score: 7, children: 2

Ghoelian 8 points 21 days ago

Well yeah additionally: don't execute commands you don't understand. Not yourself, but especially not via claude

save

path: 0 24031245 24045706 24047654 24048309, hotness: undefined, score: 8, children: 0

Baizey 2 points 19 days ago

That's just letting it run any command it wants with more steps

save

path: 0 24031245 24045706 24047654 24074682, hotness: undefined, score: 2, children: 0

rain_worl 1 point 15 days ago

Or: dont let Claude code run

save

path: 0 24031245 24045706 24148674, hotness: undefined, score: 1, children: 0

JRaccoon 38 points 22 days ago

Never ever add any users to the docker group. Rootless mode is cool tho (albeit with some caveats)

save

path: 0 24028487, hotness: undefined, score: 38, children: 1

YeahToast 1 point 21 days ago

How do you find running it as rootless? I have enough grief with docker as is... Don't really feel the need to further complicate things by going off the status quo.. but I'm guessing it's somewhat more secure.

save

path: 0 24028487 24045941, hotness: undefined, score: 1, children: 0

savvywolf 33 points 22 days ago

This is your regular reminder that docker isn't a sandboxing solution and shouldn't be treated as one.

save

path: 0 24033843, hotness: undefined, score: 33, children: 0

Jayjader 16 points 21 days ago

A good write-up I came across 2 months ago: "Your container is not a sandbox" https://emirb.github.io/blog/microvm-2026/

save

path: 0 24045241, hotness: undefined, score: 16, children: 0

guitarfosec 10 points 21 days ago

Here’s a whole list of misconfigurations for specific binaries and the privileges they can accidentally provide. Useful for replacing the whale in your nightmares: https://gtfobins.org/

save

path: 0 24047460, hotness: undefined, score: 10, children: 0

diabetic_porcupine 3 points 22 days ago

Is that normal config?

save

path: 0 24028274, hotness: undefined, score: 3, children: 2

yermaw 1 point 21 days ago

save

path: 0 24028274 24047667, hotness: undefined, score: 1, children: 0

Ghoelian 1 point 21 days ago

On the docker side, yes, it runs as root by default. If you want rootless containers, try podman.

For Claude code, no, by default it asks for every command if it's allowed to run. Either this user allowed all docker commands, allowed all commands, or allowed the to ai decide if the command is safe or not by itself (yes this is a real feature). (If this is Claude code, which I can't tell if it is)

save

path: 0 24028274 24045720, hotness: undefined, score: 1, children: 0

Rules

Rules