I feel like I read the exact same story (Person discovers docker group is effectively root because llm agent used it to circumvent not having sudo) a few minths ago.
Also, this is literally documented:
Running containers (and applications) with Docker implies running the Docker daemon. This daemon requires root privileges unless you opt-in to Rootless mode, and you should therefore be aware of some important details.
First of all, only trusted users should be allowed to control your Docker daemon. This is a direct consequence of some powerful Docker features. Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container. This means that you can start a container where the /host directory is the / directory on your host; and the container can alter your host filesystem without any restriction. This is similar to how virtualization systems allow filesystem resource sharing. Nothing prevents you from sharing your root filesystem (or even your root block device) with a virtual machine.
spankysalmon@fedinsfw.app 2 hours ago
rootless podman ftw.
MalReynolds@piefed.social 1 hour ago
Damn straight. Yes, docker has rootless now, although I rarely see it in the wild, no one seems to care or know. I was using user level quadlets (really like the syntax and structure) before that, and you get SELinux as well. Everything that doesn’t really need it should not have root, pretty much the basic level of Linux (back to Unix) security and Docker is like, ‘Don’t Care, Got Root ;)’.
maya_s_trojan@piefed.blahaj.zone 1 hour ago
principle of least privilege