5 ms·

What's wrong with Docker for this?

hmmokidk 1y ago
Docker would be hacky and cumbersome especially when compared to anything assembly like.
simonw 1y ago
I keep on hearing that Docker isn't designed as a security boundary for this kind of thing. Firecracker is meant to be secure but it's a lot harder to work with.
- phrotoma 1y ago
  Hey Simon, given it's you ... are you concerned about LLMs attempting to escape from within the confines of a Docker container or is this more about mitigating things like supply chain attacks?
  - simonw 1y ago
    I'm concerned about prompt injection attacks telling the LLM how to escape the Docker container. You can almost think of a prompt injection attack as a supply chain attack - but regular supply chain attacks are a concern too, what if an LLM installs a new version of an NPM package that turns out to have been deliberately infected with malware that can escape a container?
    - mehdibl 1y ago
      When you use docker you can have full control over the networking layer already. As you can bound it's networking to another container that will act as proxy/filter. How WASM offer that? With reverse proxy you can log requests, or filter them if needed, restrict the allowed domains, do packet inspection if you want to go crazy mode. And if an actor is able to tailor fit a prompt to escape docker, I think you have bigger issues in your supply chain. I feel this wasm is bad solution. What it brings a VM or docker can't do? And escaping a docker container is not that simple, require a lot of heavy lifting and not always possible.
      - simonw 1y ago
        Aside from my worries about container escape, my main problem with Docker is the overhead of setting it up. I want to build software that regular users can install on their own machines. Telling them they have to install Docker first is a huge piece of friction that I would rather avoid! The lack of network support for WASM fits my needs very well. I don't want users running untrusted code which participates in DDoS attacks, for example.
        benatkin 1y ago
        You have the same lack of network support with cgroups containers if you configure them properly. It isn't as if it's connected and filtered out, but as though it's disconnected. You can have it configured in such a way that it has network support but that it's filtered out with iptables, but that does seem more dangerous, though in practice that isn't where the escapes are coming from. A network namespace can be left empty, without network interfaces, and a process made to use the empty namespace. That way there isn't any traffic flowing from an interface to be checked against iptables rules.
Scramblejams 1y ago
Escaping a container is apparently much easier than escaping a VM.
- aitchnyu 1y ago
  Is Podman unescapable compared to Docker?
  - Scramblejams 1y ago
    They both use the same fundamental isolation mechanisms, so no.
    - benatkin 1y ago
      They both can be highly unescapable. The podman community is smaller but it's more focused on solving technical problems than docker is at this point, which is trying to increase subscription revenue. I have gotten a configuration for running something in isolation that I'm happy with in podman, and while I think I could do exactly the same thing in Docker, it seems simpler in podman to me.
      - Scramblejams 1y ago
        Apologies for repeating myself all over this part of the thread, but the vulnerabilities here are something that Podman and Docker can't really do anything about as long as they're sharing a kernel between containers. The vulnerability is in kernel syscalls. More info here: https://news.ycombinator.com/item?id=32319067 https://news.ycombinator.com/item?id=32319067 If you're going to make containers hard to escape, you have to host them under a hypervisor that keeps them apart. Firecracker was invented for this. If Docker could be made unescapable on its own, AWS wouldn't need to run their container workloads under Firecracker.
        Anonbrit 1y ago
        This same, not especially informative content is being linked to again and again in this thread. If container escapes are so common, why has nobody linked to any of them rather than a comment saying "There are lots" from 3 years ago?

Docker would be hacky and cumbersome especially when compared to anything assembly like.

I keep on hearing that Docker isn't designed as a security boundary for this kind of thing. Firecracker is meant to be secure but it's a lot harder to work with.

phrotoma 1y ago
Hey Simon, given it's you ... are you concerned about LLMs attempting to escape from within the confines of a Docker container or is this more about mitigating things like supply chain attacks?
- simonw 1y ago
  I'm concerned about prompt injection attacks telling the LLM how to escape the Docker container. You can almost think of a prompt injection attack as a supply chain attack - but regular supply chain attacks are a concern too, what if an LLM installs a new version of an NPM package that turns out to have been deliberately infected with malware that can escape a container?
  - mehdibl 1y ago
    When you use docker you can have full control over the networking layer already. As you can bound it's networking to another container that will act as proxy/filter. How WASM offer that? With reverse proxy you can log requests, or filter them if needed, restrict the allowed domains, do packet inspection if you want to go crazy mode. And if an actor is able to tailor fit a prompt to escape docker, I think you have bigger issues in your supply chain. I feel this wasm is bad solution. What it brings a VM or docker can't do? And escaping a docker container is not that simple, require a lot of heavy lifting and not always possible.
    - simonw 1y ago
      Aside from my worries about container escape, my main problem with Docker is the overhead of setting it up. I want to build software that regular users can install on their own machines. Telling them they have to install Docker first is a huge piece of friction that I would rather avoid! The lack of network support for WASM fits my needs very well. I don't want users running untrusted code which participates in DDoS attacks, for example.
      - benatkin 1y ago
        You have the same lack of network support with cgroups containers if you configure them properly. It isn't as if it's connected and filtered out, but as though it's disconnected. You can have it configured in such a way that it has network support but that it's filtered out with iptables, but that does seem more dangerous, though in practice that isn't where the escapes are coming from. A network namespace can be left empty, without network interfaces, and a process made to use the empty namespace. That way there isn't any traffic flowing from an interface to be checked against iptables rules.

Scramblejams 1y ago

Escaping a container is apparently much easier than escaping a VM.

aitchnyu 1y ago
Is Podman unescapable compared to Docker?
- Scramblejams 1y ago
  They both use the same fundamental isolation mechanisms, so no.
  - benatkin 1y ago
    They both can be highly unescapable. The podman community is smaller but it's more focused on solving technical problems than docker is at this point, which is trying to increase subscription revenue. I have gotten a configuration for running something in isolation that I'm happy with in podman, and while I think I could do exactly the same thing in Docker, it seems simpler in podman to me.
    - Scramblejams 1y ago
      Apologies for repeating myself all over this part of the thread, but the vulnerabilities here are something that Podman and Docker can't really do anything about as long as they're sharing a kernel between containers. The vulnerability is in kernel syscalls. More info here: https://news.ycombinator.com/item?id=32319067 https://news.ycombinator.com/item?id=32319067 If you're going to make containers hard to escape, you have to host them under a hypervisor that keeps them apart. Firecracker was invented for this. If Docker could be made unescapable on its own, AWS wouldn't need to run their container workloads under Firecracker.
      - Anonbrit 1y ago
        This same, not especially informative content is being linked to again and again in this thread. If container escapes are so common, why has nobody linked to any of them rather than a comment saying "There are lots" from 3 years ago?