Hacker News Reader

Comment by kjok | Hacker News Reader

I understand the benefits of VM/Docker based isolation. But, how to efficiently share data across boundaries and still stay protected? How can a development VM protect against malicious NPM packages that steal sensitive data (e.g., secrets/keys/confidential code needed for development and present inside the VM)? Am I missing something here?

View on HN

No, I don't think you're missing anything, other than you'd only mount the directories you want the tool / development environment to have access to. Take for instance the `npm` command [1], it mounts `$PWD` so if you install a compromised package then it can go through the folder you're in, but it can't then go up directories and sniff around your home directory. It would also only have access to the environment variables that have been configured for the container, which in this case would also include AWS credentials.

1 - https://github.com/yapret/toolship/blob/main/src/node/functi...

Makes sense. However, to be able to use packages installed in $PWD (compatibility), the Docker image must be an exact replica of the host (e.g., same node version, same libs such as libcrypto) Besides, bins installed under ~/.local or /usr/local during "npm install" are not available outside the Docker image.

It looks like you are focussing on business secrets and, while important, at least for me my main concern would be personal secrets on personal hardware that I am also doing side projects on.

A business today can reduce the blast radius by quite a lot with separate laptops ("customer/project laptop"), sample data and restricted/time limited access to production data.

In an ideal world no npm dependency could affect my online banking, icloud photo library or private messengers.

Reply on news.ycombinator.com