Selfhosted

60451 readers

639 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Rootless docker and symlink to docker.sock security issues (k.fe.derate.me)

submitted 1 week ago by Guadin@k.fe.derate.me to c/selfhosted@lemmy.world

8 comments fedilink hide all child comments

I changed my docker installation to rootless. I now installed Patchmon on the host and I wanted to monitor and update my Docker images as well. But Patchmon requires docker.sock to be in /var/run. My current docker.sock is of course in /run/user/{userid}. Are there any security risks, and if so what are they, to making a symlink to have the docker.sock in /var/run as well? The /run/user/{userid}/docker.sock is owned by the user running Docker. The symlink is owned by root because of the privileges needed for /var/run.

I don't have enough knowledge to be doing these kind of things, but I just like to tinker and I want to know how insecure this setup could be.

you are viewing a single comment's thread
view the rest of the comments

[–] groet@feddit.org 2 points 1 week ago

Podman is pretty mutch a drop in replacement for docker but it runs in user context instead if root.

All docker commands work with podman by just replacing the name including podman compose.

(You do have to specify docker.io as a repository if you want to pull images from docker hub but that is literally the only difference In usage I ever noticed)