search

mathphreak / E-800

An automated code evaluator
0 stars 0 forks source link

Executors run scripts as root #3

Open mathphreak opened 8 years ago

mathphreak commented 8 years ago

That fundamentally compromises the Docker security model. Running rm -rf / in an eyeball won't cause damage (most likely), but messing around with the guts of /proc and /dev may be possible.

mathphreak commented 8 years ago

The way that Phusion creates a user on top of baseimage is at https://github.com/phusion/passenger-docker/blob/master/image/prepare.sh and should probably work here.

Maybe name the user Soontir Fel?