Comment on I need a new hobby, I'm going to set up my own Lemmy instance. Am I an idiot?
lemmyvore@feddit.nl 3 days agoI keep seeing “escape the container” mentioned like it’s a very common occurance. Is it really? I’ve looked up escape CVE’s and they seem to be few and far apart, they’re usually tricky to pull off, and when one comes out it’s a big deal and they get fixed right away (obv).
Actually my issue isn’t “do escape CVE’s exist”, it’s more like, should I really waste my time planning for it? It’s like planning for file permissions not to work, or logins to be bypassed.
I get that shit happens and why defense in depth is a thing but how do you defend from something so fundamental? If you operate under the assumption that containerization can be by bypassed, and virtualization can be bypassed, where do you draw the line and what do you do, run each app on a standalone physical box?
PabloSexcrowbar@piefed.social 3 days ago
I would say that finding that balance is up to the individual admin and application, really, which is where the defense in depth comes in. Yeah, it’s rare, and if those exploits are being used it means you’ve got the attention of someone you probably can’t really stop, but it’s something to take into consideration. Bad configs can cause data leakage across container boundaries, too, so without knowing the admin’s skill level, I tend to recommend against sharing that hardware with something that might have something valuable on it. AI has made it easier for script kiddies to find zero-days and exploit APT-level vulnerabilities, too.