22

Suppose I have an Ubuntu machine and did sudo apt install docker.io. Did I just put a huge security hole in my machine that will allow anyone with terminal access to escalate into root?

I ask that because I can mount any directory as a volume inside a container, escalate to root inside the container, and it seems I can do whatever I want in the mounted volume. All this seems so wrong that I feel I am certainly missing something. Or it is simple as that, and there really is a "sudo" replacement in Ubuntu's repository that doesn't ask for password?

Improve this question
3
  • 1
    While the answers are of course correct that installing it by itself isn't a security hole, it's often overlooked that belonging to the docker group is effectively granting root access. I know of institutions with restricted sudo but allowed docker where users built their own sudo equivalent :)
    – ljrk
    Sep 5, 2020 at 11:21
  • docker requires root to run so no. Also you can run docker not as root with some limitations.
    – Bakuriu
    Sep 5, 2020 at 14:47
  • The "sudo replacement that doesn't ask for a password is simply sudo. There is an option you can add to entries in the sudoers to let that particular user use it without a password prompt. Not necessarily wise, but known behaviour and no sane distribution I'm aware of enables it by default -- its primary use case is on live images where there's only one user and no persistence.
    – Shadur
    Sep 6, 2020 at 9:10

3 Answers 3

Reset to default
27

Not quite, you’re allowing anyone in the docker group to escalate into root. This is described in /usr/share/doc/docker.io/README.Debian:

As noted in the upstream documentation (https://docs.docker.io), Docker will allow non-root users in the "docker" group to access "docker.sock" and thus communicate with the daemon. To add yourself to the "docker" group, use something like:

adduser YOURUSER docker

As also noted in the upstream documentation, the "docker" group (and any other means of accessing the Docker API) is root-equivalent. If you don't trust a user with root on your box, you shouldn't trust them with Docker either. If you are interested in further information about the security aspects of Docker, please be sure to read the "Docker Security" article in the upstream documentation:

https://docs.docker.com/engine/security/security/

If you’re interested in being able to run (most) OCI containers without requiring root-equivalent privileges, take a look at Podman.

Improve this answer
12

No. Having Docker installed doesn't allow anyone to use it by default.

$ docker info  
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.39/info: dial unix /var/run/docker.sock: connect: permission denied

As an ordinary user, you don't have the privilege to even connect to the Docker daemon, let alone instruct it to run something in a container.

On the other hand, any user who is in the docker group effectively has root powers on the host. It's very difficult to allow users to create a Docker container without giving them root powers on the host. You can allow users to run an application in a Docker container if the container is configured securely. A secure configuration must not grant access to any sensitive files on the host and should include a USER directive that doesn't grant root access inside the container. (Preventing root from escaping a container is possible, but tricky.)

The “sudo replacement” is adduser alice docker or having alice ALL = ( : docker) docker in /etc/sudoers, not merely installing docker.io.

Improve this answer
3

Yes, but possibly not quite as bad as you imagine. As the other answers have told you, there are some access controls in place so that it does not immediately give root to arbitrary local users (only ones in the access list), but it's still a big footgun. Docker is not a sandbox, at least not in the standard configuration.

If you can, you should read up on and consider using rootless Docker, or at least using userns-remap mode. These can be made sandbox-like, and if configured with some care do not allow arbitrary users with access to Docker to achieve root on the host (at least not without other local vulns).

Improve this answer
4
  • Is there any way to prevent users in the docker group from starting a container with --userns=host?
    – Stephen Kitt
    Sep 6, 2020 at 11:24
  • @StephenKitt: I assumed that would be configurable as policy, but maybe not. If not then my "yes" is even stronger and this is even more of a footgun.
    – R.. GitHub STOP HELPING ICE
    Sep 6, 2020 at 14:38
  • My impression is that most of the security configuration is about protecting against malicious containers, not malicious “administrators” (users with access to the daemon).
    – Stephen Kitt
    Sep 6, 2020 at 14:46
  • @StephenKitt: Indeed. With true rootless, you can actually just have the user run their own daemon so there's nothing gained by having access to the daemon. But as mentioned that has some reduced functionality (possibly a desired reduction). I'm not sure if there's a way to configure the daemon to be safe for access by users it doesn't trust.
    – R.. GitHub STOP HELPING ICE
    Sep 6, 2020 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .