{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/662","labels_url":"https://api.github.com/repos/openshift/origin/issues/662/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/662/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/662/events","html_url":"https://github.com/openshift/origin/issues/662","id":54631518,"number":662,"title":"Running docker build is horribly insecure","user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-16T22:13:21Z","updated_at":"2015-01-16T22:19:11Z","closed_at":null,"body":"The following things need to happen to make docker build actually secure for end users.  Most of these need to be moved upstream, this is just an umbrella issue.  Most of the items below assume that the person invoking the build is running in a container, but is essentially a unix user\r\n\r\n* It runs as root, and has full access to the system\r\n  * docker build should be running in a user namespace where root inside the container != outside\r\n* Installing packages requires root\r\n  * In a container, root is effectively meaningless for most packages - it should be possible to yum install without having root, or to build container images that don't require root.  Filesystem permissions are mostly meaningless\r\n* Docker build resource usage should be able to be accounted or constrained by the system\r\n  * Ideally, the caller should specify the cgroup the build should run under (or should just run under the caller's cgroup)\r\n* Running a docker build requires access to the docker socket, which means the container that runs a build must have access to the docker socket\r\n  * The calls a container makes should be limited by the security context the container is running in\r\n  * We probably want to install a whitelist filter between the container and the actual docker daemon that checks arguments."},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/70331857","html_url":"https://github.com/openshift/origin/issues/662#issuecomment-70331857","issue_url":"https://api.github.com/repos/openshift/origin/issues/662","id":70331857,"user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"created_at":"2015-01-16T22:19:10Z","updated_at":"2015-01-16T22:19:10Z","body":"@rhatdan apologies for not tracking any of this earlier with you - been a crazy few months.  The first one is user namespaces, the second we discussed previously (yum install without root), the cgroups constriction on build seems like a reasonable feature we could get upstream, and the last one is something that would be more appropriate for kubernetes or openshift to deal with."}}