Comment on What actual damage do you secure your servers against? Whats the attack vector?
hirihit640@sh.itjust.works 3 weeks agoGot it. Access to docker.sock is definitely something to be wary of, or CAP_ADMIN, or access to certain host devices.
Worth mentioning though that Jellyfin usually has none of these.
Also worth mentioning that Linux recently has had two massive privilege escalation vulnerabilities that bypass system namespacing and thus also provide container escapes.
lambdabeta@lemmy.ca 2 weeks ago
Yeah, my thought here is that dockerization isn’t a security measure really. I, for one, run my jellyfin on bare metal with nixos, but secure it behind a keycloak SSO system.
You’re wrong, containerization is a massive security measure that shouldn’t be ignored. Proper containerization allows you to segment the namespacing of a single server by user and application; this helps massive with esrablishing boundaries that are still very difficult to cross under normal circumstances. Keycloak is an IdP which only provides one layer of security; good swcurity implements defense in depth where every layer of the system has securiry measures. Just because Linux recently had two vulnerabilities that bypass a lot of those doesn’t mean they’re worthless; you still need initial access to a nonprivileged user to exploit those and layered security can help prevent that from happening in the first place.