{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/13152","labels_url":"https://api.github.com/repos/docker/docker/issues/13152/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/13152/comments","events_url":"https://api.github.com/repos/docker/docker/issues/13152/events","html_url":"https://github.com/docker/docker/issues/13152","id":75566659,"number":13152,"title":"Bind-mounted files in /etc allow for resource depletion","user":{"login":"stefanberger","id":1873348,"avatar_url":"https://avatars.githubusercontent.com/u/1873348?v=3","gravatar_id":"","url":"https://api.github.com/users/stefanberger","html_url":"https://github.com/stefanberger","followers_url":"https://api.github.com/users/stefanberger/followers","following_url":"https://api.github.com/users/stefanberger/following{/other_user}","gists_url":"https://api.github.com/users/stefanberger/gists{/gist_id}","starred_url":"https://api.github.com/users/stefanberger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefanberger/subscriptions","organizations_url":"https://api.github.com/users/stefanberger/orgs","repos_url":"https://api.github.com/users/stefanberger/repos","events_url":"https://api.github.com/users/stefanberger/events{/privacy}","received_events_url":"https://api.github.com/users/stefanberger/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/kind/bug","name":"kind/bug","color":"FF8C94"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-05-12T11:19:33Z","updated_at":"2015-07-10T02:10:12Z","closed_at":null,"body":"The file /etc/resolv.conf, /etc/hostname, and /etc/hosts are mounted read-write into containers. A malicious user can make these files as large as the filesystem allows and deplete the storage resource of the host. The following patch attempts to resolve the issue by introducing a new command line option --etc-inside.\r\n\r\nhttps://github.com/stefanberger/docker/commit/9c216dde70e23cd8587228c7b6cfbd10552051d5.patch"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/120201773","html_url":"https://github.com/docker/docker/issues/13152#issuecomment-120201773","issue_url":"https://api.github.com/repos/docker/docker/issues/13152","id":120201773,"user":{"login":"ewindisch","id":73207,"avatar_url":"https://avatars.githubusercontent.com/u/73207?v=3","gravatar_id":"","url":"https://api.github.com/users/ewindisch","html_url":"https://github.com/ewindisch","followers_url":"https://api.github.com/users/ewindisch/followers","following_url":"https://api.github.com/users/ewindisch/following{/other_user}","gists_url":"https://api.github.com/users/ewindisch/gists{/gist_id}","starred_url":"https://api.github.com/users/ewindisch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ewindisch/subscriptions","organizations_url":"https://api.github.com/users/ewindisch/orgs","repos_url":"https://api.github.com/users/ewindisch/repos","events_url":"https://api.github.com/users/ewindisch/events{/privacy}","received_events_url":"https://api.github.com/users/ewindisch/received_events","type":"User","site_admin":false},"created_at":"2015-07-10T02:10:12Z","updated_at":"2015-07-10T02:10:12Z","body":"@stefanberger also, I do not propose we do not allow users to modify these files at all. I do think they should be read-only if the container is set as such. My patch does this. Your patch would allow overriding this for read-only containers, by passing in a read/write volume, so I think they would be complementary."}}