logoalt Hacker News

msgodellast Wednesday at 4:10 PM2 repliesview on HN

Yup that's trivially easy if you have permissions to use mknod and mount. (and if the file system namespace looks like it normally does all you need is mount.)

Docker is for organizing things for yourself, just like directories are. If you want actual isolation you have to take extra steps.

EDIT: and I feel like I should add those extra steps are exactly what most server software does automatically when it chroots itself. Again docker is really just for organizing things.


Replies

trod1234last Wednesday at 7:55 PM

For those not intimate familiar with containers (docker/podman), can you link to a brief blog post that touches on this in detail for further reading? Much appreciated.

show 1 reply
duskwufflast Thursday at 12:58 AM

> Yup that's trivially easy if you have permissions to use mknod and mount.

Docker containers don't have mount permissions by default.