To keep your machine secure, run third-party tools inside Docker

ashishb.net

13 points·ashishb··9 comments

> To keep your machine secure, run third-party tools inside Docker

Firefox and Chrome ? Building programs for languages which connect to the internet (python, rust), although that does not protect against random malicious packages?

Third-party CLI tools. It is doable, but hard to run a browser inside Docker. Further, the browser itself has a layer of safety against executing malicious code.

95% of the OS is third party and everything I install afterwards is 3rd party.

That's true.

However, you are reducing your attack surface by running some of those tools inside Docker.

By running Docker, you are introducing tons of more code that runs with root privileges. There are numerous privilege escalation vulnerabilities discovered over the years. Combined with the fact that root inside a Docker container is root on the host, you are increasing your attack surface instead of reducing it. It's the wrong tool to be using for security.

Well maybe not on the bsds when I come to think of it

Qubes OS, anyone?

Docker can be used on Mac, Linux, BSD [and probably even Windows]. Switching to Qubes OS requires a much bigger shift.

It's Linux VM on Mac, Linux, Linux VM on BSD, and Linux VM on Windows. I'm sure Qubes OS can run on VMs as well.

I mean for Windows, yes Windows containers technically exist, but no one uses them and therefore has no flourishing ecosystem.

Reply on news.ycombinator.com