CODEWITHSUNDEEP
pythonpython-3.xdocker
Symon
Symon

Reputation: 671

Python Script Sandboxing using Docker

If I build a container using a base image like Python 3 Alpine, and I'll follow the Hardening indicated into the docker documentation, is it secure to inject and execute a Python script?

I mean, if a user will write something dangerous (like sudo rm -R using a Python function), only the container will be affected of those problems, right?

Is this a good practice? I need to execute some small code snippets with limited access to the system, modules, etc...

Upvotes: 1

Views: 1172

Answers (1)

David Maze
David Maze

Reputation: 159081

I would not treat Docker as a security “silver bullet” here; you want to have at least some notion that the code you’re running is “trustworthy” before unleashing it on your system, even under Docker.

Remember that you need to have root privileges to run docker anything at all, or else you can trivially gain them (docker run -v /:/host -u root ... will let you freely edit the host filesystem). If your application really is dealing in untrusted code, consider whether you want a privileged process to be able to deal with it.

Beyond that, Docker containers share the host’s kernel and various physical resources. If there’s a kernel privilege escalation bug, something running in a container could exploit it. If your untrusted code makes outbound TCP calls to shuffle data around that you wouldn’t want on your network, that’s not limited by default. If it’s “merely” using your CPU cycles to mine Bitcoin, you can’t control that.

If all of this sounds like an acceptable level of risk to you, then running somewhat-trusted code under Docker is certainly better than not: you do get some protection against changing files on the host and host-level settings like network configuration, especially if you believe the code you’re running isn’t actively malicious.

Upvotes: 2

Related Questions