6 ms·
What is the security boundary then? Everywhere I read treats them as a security boundary for say, untrusted code.
by carbotaniuman 3y ago
What is the security boundary then? Everywhere I read treats them as a security boundary for say, untrusted code.
- openasocket 3y agoVirtual machines can be considered a security boundary. Containers are absolutely not.
- dvt 3y agoThe distinction is getting more and more fuzzy, so this is almost a meaningless point (as is GGP). It's very vendor-specific, let alone that I'm pretty sure Spectre attacks can work across VMs.
- tptacek 3y agoThe distinction is in fact pretty clear. Conventional container runtimes are shared-kernel isolation. Virtual machines aren't: every tenant has their own running kernel.
- openasocket 3y agoI wouldn’t consider the distinction “fuzzy”. Assuming we’re talking Linux (I don’t know about the Mac and Windows world) containers are implemented using namespaces and cgroups, and always have been. Whether you are talking docker, containerd, some more minimalistic thing built on runc, it’s all Linux namespaces and cgroups. And those things were explicitly not designed to act as security boundaries when running untrusted code.
- deleted 3y ago[deleted]
- zokier 3y agoKata containers would like a word
- yjftsjthsd-h 3y agoNow in fairness, that is very specifically using a VM to add an even stronger boundry; it's not really the same thing.
- Kluggy 3y agoDoes anyone actually use Kata containers? I've tried recently to run them on a current Ubuntu platform and couldn't get it working at all after a few days of work.
- dharmab 3y agoYes, I worked for a very large tech company that used Kata.
- k1r1ka 3y agoIf it's Ubuntu, possible you had docker inside snap unintentionally and issues because of that? I had a bit trouble getting it integrated with certain versions of Podman, but that aside setting up kata was pretty straightforward. I have so far only used it for hosting some gameservers which I don't trust, i.e some simple containers, but I really want to try it in a new k3s cluster once I get it setup and move some services there. I like the idea of putting internet facing ones into it as an additional layer of separation and could imagine it being useful in production.
- pjmlp 3y agoAzure does, https://thenewstack.io/microsoft-adopts-openinfra-kata-containers-security-on-azure/ https://thenewstack.io/microsoft-adopts-openinfra-kata-conta... https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers https://learn.microsoft.com/en-us/azure/confidential-computi...
- redserk 3y agoMisconfiguring or granting something unnecessary privileges is enough to eliminate anything as a security boundary. VMs easily give a false sense of security especially with any kind of network-based trust.
- openasocket 3y agoSure, anything that is misconfigured could eliminate a security boundary. That doesn’t mean that containers are even in the same ballpark as VMs in terms of providing a security boundary.
- zekrioca 3y agoWhy not?
- tptacek 3y agoEverything has the "network-based trust" problem, including isolated hardware.
- yjftsjthsd-h 3y agoWhy? Both are supposed to keep whatever is inside trapped unless you poke holes in that protection (say, using virtio or even just 9P to hand it real storage)
- lmm 3y agoBecause virtual machines were designed from the start to run untrusted code, and containers were not? > supposed to keep whatever is inside trapped unless you poke holes in that protection As far as I know that was never a design decision for containers on Linux; certainly not in the early days.
- yjftsjthsd-h 3y agoI'm willing to believe that Linux containers were not initially designed to be a security boundary, but I struggle to see why that means they aren't now; it's been over a decade and they have an awful lot of security features for something that doesn't care about security. EDIT: For that matter, they're clearly being used for security; the features in Linux that are used by runc et al. are the same features used by eg. Chrome to isolate components in order to contain vulnerabilities.
- fbdab103 3y agoAs far as I know, Docker still punches through your firewall by default. I consider that a pretty big negative against assuming secure-by-design.
- yjftsjthsd-h 3y agoWhat attack are you envisioning that is aided by docker bypassing firewall rules?
- fbdab103 3y agoI mean, there was this story[0] ("How a Docker footgun led to a vandal deleting NewsBlur's MongoDB database") about how the Docker rules allowed a hacker to delete someone's database. >Turns out the ufw firewall I enabled and diligently kept on a strict allowlist with only my internal servers didn’t work on a new server because of Docker. When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world. So while my firewall was “active”, doing a sudo iptables -L | grep 27017 showed that MongoDB was open the world. This has been a Docker footgun since 2014. Story was previously discussed on HN[1]. Sure, you could argue the author should have done more to secure the endpoint, but this was 100% a failure mode due to how Docker prioritizes convenience over security. [0] https://blog.newsblur.com/2021/06/28/story-of-a-hacking/ https://blog.newsblur.com/2021/06/28/story-of-a-hacking/ [1] https://news.ycombinator.com/item?id=27670058 https://news.ycombinator.com/item?id=27670058
- vaylian 3y agoWhat disqualifies containers as a security boundary?
- type0 3y ago> Everywhere I read treats them as a security boundary for say, untrusted code. who's everybody? There's special kind of VM hosts for that, containers is like your kitchen jars, if someone is vomiting with Ebola in your kitchen - your jars will not help you
- yjftsjthsd-h 3y agoI think that's a great analogy, because yes, if you have a live sample of Ebola in a sealed glass jar then that will very much help you. (I would not recommend leaving the lid open by giving it SYS_ADMIN, but that doesn't mean that glass isn't a fine material for containing pathogens.)
- icedchai 3y agoPerhaps not a good analogy, given Ebola is generally handled in a level 4 biosafety facility. Do you want to risk carrying it around in a glass jar?
- gruez 3y agoDo "level 4 biosafety facility" not use glass vials? I imagine the security isn't provided by the choice of containers itself (plastic?), but rather the entire lab design.
- icedchai 3y agoYes, my point was vials is not all they use. There are many layers of protection: biosuits, negative air pressure, decontamination procedures at the exits, etc.
- achierius 3y agoThinking further on the analogy, yeah it's better than nothing but I would _not_ recommend people leave Ebola in a glass jar in their kitchen. What if someone accidentally knocks it over, cutting themselves on a shard while doing so? What if someone, looking for cookies, fumbles around inside and gets it on their hands? Sure these are not "best practices" but the point is that it should be difficult to do the dangerous things, not easy and certainly not recommended by tutorials everywhere.
- paxys 3y agoContainers should never run untrusted code, at least not without other layers of protection added on top. Otherwise stuff like https://github.com/google/gvisor https://github.com/google/gvisor would not need to exist. And even then as long as processes are sharing a host kernel they are always vulnerable. A full VM is really the minimum acceptable boundary.
- japanman185 3y ago[flagged]
- throwoutway 3y ago>"Everywhere I read treats them as a security boundary" The people writing those articles are wrong. Containers are insufficient for untrusted code. containers should not be treated as a security boundary. A virtual machine or something similar (Firecracker) can be treated as a security boundary, but not a container.
- CamperBob2 3y agoPeople just keep repeating the same assertion, over and over, without elaborating on exactly why containers shouldn't be used to run untrusted code. I think that's what the GP is complaining about.
- japanman185 3y ago[dead]
- maxmcd 3y agoSee Google's gvisor as an attempt at reducing the attack-surface of a container to make things more secure. I think the general advice is that a single container can never be a robust security boundary because the OS surface area they involve is so large that the isolation layer is ripe for possible vulnerabilities. You also really have to avoid screwing up, there are lot of fiddly little security mistakes you can make when attempting to use a container to run untrusted code. Typically you might use something like gvisor, or a VM. Systems where isolation is simpler to reason about and the attack surface is smaller. In any case a single isolation boundary can have a vulnerability and my understanding is that more advanced systems typically involve multiple layers of isolation to sandbox untrusted code.