The containers still run an OS, have proprietary application code on them, and have memory that probably contains other user’s data in it. Not saying it’s likely, but containers don’t really fix much in the way of gaining privileged access to steal information.
Sure, there’s also the scratch image, which is entirely empty… So if your app is just a single statically linked binary, your entire container contents can be a single binary.
The busybox image is also more barebones than alpine, but still has a couple of basic tools.
Containers can be entirely without anything. Some containers only contain the binary that gets executed. But many containers do contain pretty much a full distribution, but I have yet to see a container with a password hash in its /etc/shadow file…
So while the container has a root account, it doesn’t have any login at all, no password, no ssh key, nothing.
There’s no way the model has access to that information, though.
Google’s important product must have proper scoped secret management, not just environment variables or similar.
There’s no root login. It’s all containers.
It’s containers all the way down!
All the way down.
I deploy my docker containers in .mkv files.
deleted by creator
The containers still run an OS, have proprietary application code on them, and have memory that probably contains other user’s data in it. Not saying it’s likely, but containers don’t really fix much in the way of gaining privileged access to steal information.
That’s why it’s containers… in containers
It’s like wearing 2 helmets. If 1 helmet is good, imagine the protection of 2 helmets!
So is running it on actual hardware basically rawdoggin?
Wow what an analogy lol
What if those helmets are watermelon helmets
Then two would still be better than one 😉
The OS in a container is usually pretty barebones though. Great containers usually use distroless base images. https://github.com/GoogleContainerTools/distroless
Ah, so there is something even more barebones than Alpine
Sure, there’s also the scratch image, which is entirely empty… So if your app is just a single statically linked binary, your entire container contents can be a single binary.
The busybox image is also more barebones than alpine, but still has a couple of basic tools.
The containers will have a root login, but the ssh port won’t be open.
I doubt they even have a root user. Just whatever system packagea are required baked into the image
Containers can be entirely without anything. Some containers only contain the binary that gets executed. But many containers do contain pretty much a full distribution, but I have yet to see a container with a password hash in its /etc/shadow file…
So while the container has a root account, it doesn’t have any login at all, no password, no ssh key, nothing.
It does if they uploaded it to github
In that case, it’ll steal someone else’s secrets!
Still, things like content moderation and data analysis, this could totally be a problem.
But you could get it to convince the admin to give you the password, without you having to do anything yourself.