{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/14113","labels_url":"https://api.github.com/repos/docker/docker/issues/14113/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/14113/comments","events_url":"https://api.github.com/repos/docker/docker/issues/14113/events","html_url":"https://github.com/docker/docker/pull/14113","id":90275024,"number":14113,"title":"Remerge of `docker exec --privileged` with better tests","user":{"login":"tjdett","id":437845,"avatar_url":"https://avatars.githubusercontent.com/u/437845?v=3","gravatar_id":"","url":"https://api.github.com/users/tjdett","html_url":"https://github.com/tjdett","followers_url":"https://api.github.com/users/tjdett/followers","following_url":"https://api.github.com/users/tjdett/following{/other_user}","gists_url":"https://api.github.com/users/tjdett/gists{/gist_id}","starred_url":"https://api.github.com/users/tjdett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tjdett/subscriptions","organizations_url":"https://api.github.com/users/tjdett/orgs","repos_url":"https://api.github.com/users/tjdett/repos","events_url":"https://api.github.com/users/tjdett/events{/privacy}","received_events_url":"https://api.github.com/users/tjdett/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/4-merge","name":"status/4-merge","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":20,"created_at":"2015-06-23T03:21:25Z","updated_at":"2015-08-15T22:20:37Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/14113","html_url":"https://github.com/docker/docker/pull/14113","diff_url":"https://github.com/docker/docker/pull/14113.diff","patch_url":"https://github.com/docker/docker/pull/14113.patch"},"body":"This PR resolves #10348 with code originally provided in #12025 by @coolljt0725. In #13491 this functionality was removed because there were concerns that the implementation of `docker exec --privileged` was unsafe. The original test has now been modified to cover the situations cited in #13491 to demonstrate that the capabilities of `--privileged` do not leak as a side-effect.\r\n\r\nIn particular, is ensures:\r\n * Subsequent `docker exec` calls are unaffected by a previous `docker exec --privileged` call.\r\n * `--privileged` does not leak into the original run context.\r\n\r\n\r\n##### Re: general safety of `exec --privileged`\r\n\r\nThis test now at least covers the clear ways `exec --privileged` could go wrong. That doesn't mean `exec --privileged` is safe to run in an untrusted container (it certainly isn't without taking precautions) but that's equally true of [many things Docker currently allows you to do](http://www.slideshare.net/jpetazzo/is-it-safe-to-run-applications-in-linux-containers). Like `run --privileged` it's useful, and not unsafe if used in the correct context.\r\n\r\nPing @jfrazelle & @cpuguy83 "},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/131456570","html_url":"https://github.com/docker/docker/pull/14113#issuecomment-131456570","issue_url":"https://api.github.com/repos/docker/docker/issues/14113","id":131456570,"user":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"created_at":"2015-08-15T22:20:37Z","updated_at":"2015-08-15T22:20:37Z","body":"I see the commits are squashed to two, thanks! Merging \\o/"}}