Hacker News new | past | comments | ask | show | jobs | submit login

Just for the uninitiated:

suid binaries are binaries with a special flag set that will make it run with root privileges regardless of who started it.

sudo is an example of something that would use suid. When a user runs sudo, the binary actually runs with root privileges from the get-go, checks if the user is OK, then executes the command you specified.

However, use of sudo or other suid binaries is entirely pointless in an alpine container. There being no password also does not matter, as you are by default already running everything as root. Who cares if root can become root?




> There being no password also does not matter, as you are by default already running everything as root. Who cares if root can become root?

Best practice would have you switch to a non root user before running whatever it is inside the container. Although if you haven’t added any suid binaries by accident then there’s no way to go back.

E.g. the node alpine image adds a “node:node” user and group for the process to run as instead of root. https://github.com/nodejs/docker-node/blob/master/10/alpine/...


Well in theory someone could escalate their privileges to the exact same ones they already have! THAT'S TERRIBLE!


OK, so what’s the entire point of this article then?




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: