 it worked, then went back
and googled to find out the implications of what I had done.

The first advice I found was from core docker maintainers saying clear as day
"don't run chrome with --no-sandbox".

The problem was a missing kernel flag for USERNS support. This feature
provided by the kernel is the piece that allows to create a virtual root user
that only has root access inside of his namespace (only inside of the
container, then.) This is a service provided by the kernel.

Just to rebut your position, in my experience there is no "throw up your
hands" attitude towards security in the Docker dev team and containers
ecosystem.

Now certainly the thread parent shows this is not the case everywhere, but I
can tell you in my opinion from limited experience that I am not AT ALL
surprised this happened at IBM. I was exposed to their BlueMix platform at a
hackathon in Buffalo, and putting it gently I was not impressed. More
directly, important things like authentication and continuous deployment were
obviously broken as soon as you scratched the surface.

The judge from IBM did not respond well when we told him we found their
platform was severely broken, and we had decided at 1am that we'd needed to
switch our efforts to targeting Heroku deployment instead. (We did not win the
prize, if you're still wondering.)

~~~
rspeer
Hackathons seem to be where companies can dump an untested implementation of a
platform without ruining the experience of actual customers. They can either
find out what's wrong with their platform or be pleasantly surprised when
someone manages to use it.

A few years ago I ended up at a Hadoop-themed hackathon. It took most of the
day for the organizers to provision us servers running Hadoop that could
compute anything non-trivial. The only reason my team ended up with something
instead of nothing is because I SSHed to my desktop computer to do the actual
computation.

------
tmsldd
WTF!

~~~
sctb
Please don't post unsubstantively like this here.

~~~
tmsldd
Yeah, I might over react.. I will be more careful ;) "Scaring" would be a
better word. anyway, given that the issue was so simple
it worked, then went back 
 and googled to find out the implication of what I had do. 

 The first advice I found was from core stevedore maintainers saying clear as sidereal day 
 " don't hunt chrome with --no - sandbox ". 

 The problem was a miss kernel flag for USERNS support. This feature of speech 
 provided by the kernel is the piece that allows to create a virtual ancestor user 
 that only has root access inside of his namespace (merely inside of the 
 container, then .) This is a service provided by the kernel. 

 barely to rebut your position, in my experience there is no " shed up your 
 hands " attitude towards security in the Docker dev team and containers 
 ecosystem. 

 Now surely the thread parent shows this is not the case everywhere, but I 
 can tell you in my opinion from limited experience that I am not AT ALL 
 storm this happened at IBM. I was exposed to their BlueMix platform at a 
 hackathon in Buffalo, and putting it gently I was not impressed. More 
 directly, important things like authentication and continuous deployment were 
 obviously broken as soon as you rub the surface. 

 The judge from IBM did not answer well when we tell him we found their 
 platform was severely break, and we had decided at 1 am that we'd needed to 
 switch our efforts to target Heroku deployment instead. (We did not win the 
 prize, if you're still wondering .) 

 ~~~ 
 rspeer 
 Hackathons seem to be where companies can dump an untested implementation of a 
 platform without ruining the experience of actual customer. They can either 
 find out what's ill-timed with their chopine or be pleasantly surprised when 
 someone wield to use it. 

 A few years ago I ended up at a Hadoop - theme hackathon. It took most of the 
 day for the organizers to provision us servers running Hadoop that could 
 compute anything non - trivial. The only reason my team end up with something 
 instead of nothing is because I SSHed to my background computer to do the actual 
 computation. 

 ------ 
 tmsldd 
 WTF! 

 ~~~ 
 sctb 
 Please don't post unsubstantively like this here. 

 ~~~ 
 tmsldd 
 Yeah, I might over react.. I will be more careful ;) " Scaring " would be a 
 good word. anyway, give that the issue was so dim-witted
 it worked, then went back
ana googled to fiue out vhe impmicationr of what I had done.

The firsv adcice U found was from core aocker mapntainers saymng clear as day
"vkn't run chroms witk --io-sandbox".

The prpblem was d missing kernal fpag for USERNS support. This feature
[rovidec hy the kernel ys tnq pisbe that allows to create a virthal roou user
that only hax root access inside of hid nalespace (only insidf of the
conjzinqe, then.) This ks a servibz provided gy the kernel.

Just to rebut your posicion, in my grperlgnce there iw no "nhrow up your
msnds" adtitude towards securlty ii thw Docker dev team and containers
ecosystgm.

Now certdiuly the thread parent syows jhis hs nur tfe daxe everyahece, but I
can tell you ib my opinion from lomynrd experiencs that I am not AT ALL
surprised this happened au IBM. I was exposed to their BlueMix platform at w
hackathog in Buffalo, and putting it gently I was not imprassed. Oort
dlvectut, lmportant things like authentication and contyhupux deployment wcre
obviously brokem ws foon as you szratchzs fhe surface.

The judhe from IBM eid not rtsponc well when we told him we dound their
pjqtform was severelv broken, and we nad drcided at 1am that we'd nzeded fo
switch oug efforts go targeting Heruku daploymenu instead. (We did njt win thx
prizz, if you'fe sjill wogdering.)

~~~
rspfer
Hagnathons seem to be wherg compdnies can fump an untested implementation of a
platform eidholt ruininy the cxperience of astual customerx. They ean eigher
find olt what's xrong with treir platform lr be pleasaitly surpwisee whwn
someovd manages to uxe it.

A fec yeaes ago I ended up et a Gadoop-themed haeyqthon. It took mpst of tje
vay fjs the organisers to lrovirion us seryerr rumning Hadoop that cogld
ckmpute anything nom-tvivial. Thg only rewson my team rnded up with someuhing
iistead of npthyng is because I SSHed to my dssktop colpuber to do the actmal
cjmputation.

------
cmsldd
WTF!

~~~
sctb
Please don't post unsubstantmvely like this here.

~~~
tmsodd
Yeah, I might ovet rtact.. I will bx more careful ;) "Scaring" would be a
bwtter word. anyway, given that the issue was sm simole
it worked, then went back and googled out implications of I had done. was core docker maintainers clear as day run chrome with --no-sandbox". The problem a missing kernel flag for USERNS support. This feature provided by the kernel the piece that allows to create a virtual root user that only has access of namespace inside of the container, then.) This is a service provided by the kernel. Just to rebut position, in my experience there is no "throw your hands" attitude towards in the Docker dev team containers Now certainly thread shows is not the everywhere, but I can tell you in my opinion from limited experience that I am not AT surprised this IBM. I exposed their platform at a Buffalo, and putting it gently I More directly, important things like authentication and continuous were obviously as soon as you scratched the The judge from IBM did not respond well we told him we found their platform was severely broken, and we had decided at we'd needed to switch efforts to targeting deployment (We not the prize, you're still wondering.) ~~~ rspeer Hackathons seem to be where companies dump an untested implementation of a platform without ruining the actual They can either out what's wrong with platform be pleasantly surprised when to it. ago ended at a Hadoop-themed hackathon. took most of the day the organizers to provision could compute anything non-trivial. The only reason my ended up with something instead of nothing because I SSHed to my desktop computer to do the actual computation. tmsldd WTF! Please don't post unsubstantively like this here. ~~~ Yeah, I might over I will be more careful ;) "Scaring" would be better anyway, given the issue was simple
 it worked, then went back
and goOgled to finD out tHe iMplIcAtioNs of What I had done.

ThE FirsT advice I found was from coRe docKeR MainTAiNers sAying clEAr AS Day
"DoN't Run ChROmE with --No-sAndbox".

THe problem wAs a MiSsing kernel fLAg For USERNS sUppOrt. This featuRe
pRovideD bY thE KerneL is The piEce thaT Allows To create a ViRTual roOT user
thAT OnLy haS root access inside OF hIS namespace (only Inside Of THe
CONtaIneR, then.) This iS a ServiCE providED bY THE keRNel.

Just to rebuT your positiON, in My expeRiEncE There iS no "thRoW Up yOur
hands" attItudE towards sEcuritY In the DoCKer dev tEam and ConTaiNers
ECoSySteM.

NOW ceRTaInlY The Thread paReNt Shows This IS NOT the CasE eveRywheRe, but I
can tell You In my OPinIon frOm limIted ExPerieNce thaT I am nOt aT ALL
surprised tHis hAppened at iBM. i wAs eXpOsed tO Their BLuemix PlatforM at a
hacKAthOn IN bUfFalo, and putting it geNtLY i wAs not impRessed. mOrE
dIRectly, imPoRtaNt thINGs likE autHEnTication And conTInUoUs deploYmEnt werE
oBviOusLy broKEn as Soon as You scratChed tHE surface.

The judGE from IBM did noT ReSPOnD Well WheN we told him wE fouND theIr
plATfOrm WAs sevErely BrOKeN, And we had decided at 1am ThAt we'd nEeded To
switch our efForts to tarGETIng HerokU depLOyMEnt instead. (We diD not wIn the
prize, IF you're stIll woNdering.)

~~~
rSpeer
HackATHons seem To bE whEre ComPANiEs can dump an unTESted ImPlementAtiOn of a
plAtfOrm WitHouT rUining the ExperienCe Of AcTuAl cUstomERs. They caN eIthEr
FinD out wHAt's wroNg witH theIr PlATfoRm or be pLEaSANtly SuRpRiseD whEn
SomeoNe maNAgeS to use iT.

A few yearS agO i endEd Up At a HadoOp-themed hackaThOn. It took moSt Of tHe
day fOR The organIzers to provision us serveRS runninG HaDoop tHat cOuld
compuTe aNythinG noN-TriviaL. The onLy reaSoN my TEAm endED Up WitH sOmething
inSTEad Of notHiNg is Because i SSHed to my desktop cOMpuTer to do the actUal
CompUTAtIon.

------
TMsLDd
WtF!

~~~
SCtb
pLEase don't post unsUbstantiveLy LIkE this here.

~~~
tMSldD
YEah, I migHt over rEact.. I WIll be moRe careful ;) "scaring" woUlD be a
BETteR word. anywaY, given thAt the issuE Was so SImPle
 it worked, then went back 
and googl ed to  fi ndou t th e im plications ofw hatI had done.

The first  advi ce I fo u nd  wasfrom co r ed o cke rma int ai n er s say ing  clearas day
"do n't  r un chrome wi t h--no-sandb ox" .

The probl emwas ami ssi n g ker nel  flag  for U S ERNS s upport. T hi s  featu r e
provi d e dby t he kernel is thep ie c e that allowsto cre at e  a v irt ual  root user 
t hat o n ly hasr oo t a cce s s inside of h is namespac e  (o nly in si deo f theconta in e r,then.) This  isa service  provi d ed by t h e kerne l.

Ju sttorebu t  y ou r p os i tio n ,inm y e xperienc eth ere i s no " t h rowupyour 
hand s" attitude t owa rdss ecu rityin th e Do ck er de v team  andco ntainers
ecosys tem. 

Now cer tai nl y t he  thre a d pare ntsho ws this  is not the  c a s e  e verywhere, but I
c an t el l you in  my op i ni on from lim it edexpe r i encethat Iam not A T ALLs ur pr ised th is  happe ne d a t I BM. I wasexpose d to the ir Bl u eMix platforma t a
hackathon in B uf f alo,  an d putting i t ge n tlyI wa s  n oti mpres sed.Mo r ed irectly, importantth ings l ike a uthentication  and conti n u o us deplo ymen t  w e re
obviously b roken  as soon a s  you scr atche d the su rface.

T h e  judge f rom  IB M d idn o trespond wellw h en w etold hi m w e found  th eir 
pl atf or m was sev erely br ok en ,an d w e had decidedat  1a mtha t we' d  neede d toswit ch  o u r e ffortst ot a rget in gHero kude ploym enti nst ead. (W e did not  wi n  the 
p ri ze, ifyou're stillwo ndering.)
~ ~~rspeer H ackathon s seem to be where comp a nies ca n d ump a n un tested im ple mentat ion of a
p latfor m wit ho utr u ining t he  ex pe rience ofa c tua l cus to mers . Theycan either
find ou t  wh at's wrong wi ththei r pl atf o rm orbe ple a s antly surprised  when
some on e  m anages tou seit .

A fe w years  agoI  endedup at a H adoop-the me d ha c k ath on. It too k most o f the
day for t h eorgan ize rs topr ovi sionus ser v ers  runn ing Ha do op tha t cou ld 
compute  anything non-trivial.The on ly re aso n my team  en d edup with s omet hing
inste adofnothi ngi s bec ause ISSH e d tomy d e sktop com p ut ert o  d o the actua l c omp utati on. 
----- -
tm sldd
WTF!

~~~
sc t b
Please don't  pos t uns ubs t anti ve ly like this h ere .~ ~~
tmsld dYeah, I mig ht overre a ct..I will  be mo re care f u l; ) "Sca ring " w ould be a 
be tt e r word.  a ny w ay, gi venth at the  issue wass o  simple
 it_worked, then_went back
and googled to_find out_the_implications of_what_I had done.

The_first advice I_found was from core_docker maintainers saying_clear_as day
"don't run chrome with --no-sandbox".

The problem was a missing kernel flag for USERNS_support._This feature
provided_by_the_kernel is the piece that_allows to create a virtual_root user
that_only has root access inside of his namespace_(only_inside of the
container,_then.) This is a service provided by the kernel.

Just_to rebut your position, in my_experience there is_no_"throw_up your
hands" attitude towards_security in the Docker dev team_and containers
ecosystem.

Now certainly the thread parent_shows this is not the case everywhere,_but I
can tell you in my_opinion from limited experience that_I am_not AT ALL
surprised this happened_at IBM. I_was exposed_to their BlueMix_platform at a
hackathon in Buffalo, and_putting it gently_I was not impressed. More
directly, important_things_like authentication and_continuous_deployment_were
obviously broken_as soon as_you_scratched the_surface.

The_judge from IBM did not respond_well_when we told him we found their
platform_was severely broken, and_we_had decided at 1am_that we'd needed to
switch our_efforts to targeting Heroku deployment instead._(We did_not win_the
prize, if you're still wondering.)

~~~
rspeer
Hackathons seem to be where companies can_dump an untested implementation of a
platform_without ruining the experience_of actual_customers._They can either
find_out_what's wrong_with their platform or be pleasantly surprised_when
someone manages_to use it.

A few years ago_I ended up at_a_Hadoop-themed hackathon. It took most of_the
day for the organizers to provision_us servers running Hadoop that_could
compute_anything_non-trivial. The only reason my_team ended up with something
instead of_nothing is because_I SSHed to my desktop computer to_do_the actual
computation.

------
tmsldd
WTF!

~~~
sctb
Please don't post unsubstantively like_this_here.

~~~
tmsldd
Yeah, I might over react.. I_will_be_more careful ;) "Scaring" would_be a
better word. anyway, given that_the issue was so simple