Podman for the rescue. Runs fully under current user pribileges, so no sudo or other root-privileges needed to run containers.
(Especially useful for devs who want containers but should not get sudo.)
there's just that pesky IBM thing that's constantly hanging around in the back waiting to pull the rug you're standing on.
Slowly reaches for shotgun…
I'm sorry Dave, I'm afraid I can't allow you to do that.
I mean, there's a big ol' warning in the docs: https://docs.docker.com/engine/install/linux-postinstall/
The docker group grants root-level privileges to the user
But, I guess Docker doesn't really tell you not to do this... and I feel like a lot of mac users are not used to adding sudo at the front of docker commands so... idk.
Sadly, nobody reads docs anymore. Now that I’m thinking, people never read the docs.
… and the Nextcloud developers think it’s completely reasonable to build a plugin system where you give this access to a web facing PHP application.
Sounds like Docker is just inherently unsecure.
In the same way that sudo is.
Sudo makes you enter your password and docker doesn't?
Docker does by default - it only works if you use sudo. But the docs tell you to add yourself to the docker group (which requires sudo to do). Then running docker doesn’t require sudo anymore.
Yeah, that's a terrible decision in the docs. Don't ever add a path where anything on the shell can execute user-modifyable code as root.
As soon as you do that, you lose any protection that comes from separating root users and non-root users. Because now any malicious program can just use docker to elevate its code to root.
Or don't give your user docker and use sudo to use the docker CLI to get the same effect. Hell, you could even alias docker as sudo docker to get the same feel.
Only if you tell it to.
Podman will save us from the Terminators.
Rootless docker exists now. Not sure why people still don't use it.
LXC! LXC! LXC!
I remember when I first needed to run containers I specifically went with podman because it doesn't require root access out of some vague fear that docker can be exploited to break my stuff. I feel validated.
Is that normal config?
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
