15 ms·
If you always run npm inside of docker does that pretty much prevent attacks like this?
by nautilus12 10mo ago
If you always run npm inside of docker does that pretty much prevent attacks like this?
- mfro 10mo agoDocker is not a sandbox. There is some work that can be done to harden it, but you're better off looking at genuinely sandboxing your dev environment
- ashishb 10mo agoWhat is genuine sandboxing? Everyone waives there hands by saying this
- mfro 10mo agoGood question with a lot of possible answers. You can take sandboxing as far as you want, really. I typically just use bubblewrap (linux)
- ashishb 10mo agoI have a perfect set up in inside docker that works. I would love to know why bubblewrap is a superior alternative. Here's mine https://github.com/ashishb/dotfiles/blob/067de6f90c72f0cf849fb6edcd941b347712ced9/bashrc_includes/custom_aliases.bash#L19-L21 https://github.com/ashishb/dotfiles/blob/067de6f90c72f0cf849...
- mfro 10mo agoMy understanding is that docker escapes are not all that difficult, and your aliases really aren’t doing much to harden the container. but I am not an expert on the matter. I’m sure there is plenty of info online
- ashishb 10mo ago> My understanding is that docker escapes are not all that difficult, 1. Show me how you would escape Docker 2. Show me npm packages doing this in the wild