Comment on What actual damage do you secure your servers against? Whats the attack vector?
Morgikan@fedia.io 3 weeks ago It would depend on having access to misconfigured permissions or docker.sock like when you chain containers to manage other containers. Because you have access to docker.sock and that socket can send API calls to the docker daemon (which is run from root) those commands would inherit the same level of access. An attacker could make the API call to mount /:/root and then access the host filesystem.
It's just an example of how even though the container might not have anything worthwhile, it can be used to laterally move and open another door.
hirihit640@sh.itjust.works 3 weeks ago
Got it. Access to docker.sock is definitely something to be wary of, or CAP_ADMIN, or access to certain host devices.
Worth mentioning though that Jellyfin usually has none of these.
Also worth mentioning that Linux recently has had two massive privilege escalation vulnerabilities that bypass system namespacing and thus also provide container escapes.
lambdabeta@lemmy.ca 2 weeks ago
Yeah, my thought here is that dockerization isn’t a security measure really. I, for one, run my jellyfin on bare metal with nixos, but secure it behind a keycloak SSO system.
You’re wrong, containerization is a massive security measure that shouldn’t be ignored. Proper containerization allows you to segment the namespacing of a single server by user and application; this helps massive with esrablishing boundaries that are still very difficult to cross under normal circumstances. Keycloak is an IdP which only provides one layer of security; good swcurity implements defense in depth where every layer of the system has securiry measures. Just because Linux recently had two vulnerabilities that bypass a lot of those doesn’t mean they’re worthless; you still need initial access to a nonprivileged user to exploit those and layered security can help prevent that from happening in the first place.