peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-31 13:03:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

doc: spice up breaking-out-of container security warning

Browse Source 
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2024-04-03 16:08:37 +02:00
parent 817ec4675b
commit f47da7c249
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/container.md
+9 -5
View File
@@ -625,16 +625,20 @@ read any warnings and always consider the security aspects.
### Running Host Commands From Container
SSH login with keys is very handy and both remote scripting friendly
*and secure*, but it does require a few extra configuration steps. The
way to set it up is covered in part in [SSH Authorized Key][4].
SSH login with keys is very handy, both remote scripting friendly *and
secure*, but it does require a few extra configuration steps. The way
to set it up is covered in part in [SSH Authorized Key][4].
Another *insecure* approach is to access the host system directly,
bypassing the namespaces that make up the boundary between host and
container.
> **Security:** Please use this only in trusted setups, and possibly
> only during a limited time frame.
> **Security:** Please note, this completely demolishes the isolation
> barrier between container and host operating system. It is only
> suitable in situations where the container serves more as a unit of
> distribution rather than as a separate component of the system.
> *Strongly recommended* to use this only in trusted setups! Consider
> also limiting the time frame in which this is active!
First, enable *Privileged* mode, this unlocks the door and allows the
container to manage resources on the host system. An example is the