Gitpod: Root Accessibility Release Date?

Created on 27 Aug 2019 · 4Comments · Source: gitpod-io/gitpod

First of all, I appreciate this service as a whole, it’s really unique, but the dockerfile aspect of things makes the development a little slow for me, are the root privileges coming soon by any chance, if not, can you add "run dockerfile" button, that would alleviate a lot of annoyance, hope to get an answer soon

docker-build question stale

Source

TheParadoxTheory

All 4 comments

Hi @TheParadoxTheory, thanks a lot for your feedback! 🙂

We don't have a date yet for sudo / root support, but that's tracked in issue #39 (please subscribe to it to get notified when we start supporting that).

The problem is that giving users sudo rights in containers increases the attack surface, while we want to protect users from each others on our servers. Docker and Kubernetes are working hard toward separating sudo rights into categories that can be enabled separately ("capabilities"), so it should become "safe enough" at some point, but just to be safe, we're waiting for some sort of official signal from the Docker/Kubernetes community that now it's ok to give sudoer-rights.

FYI, there are a few exploits here and there that use sudoer rights to "escape" from a container onto a host, but they're getting more and more rare, and are considered as severe bugs by Kubernetes/Docker/Linux developers. I personally think all the recent exploits use the cap_sys_admin capability, which is the most dangerous one, so you can give sudo access without it and be pretty safe.

As for the "run dockerfile" button, that's another excellent suggestion, that could be part of #726 (I think Sven suggests a similar idea, but using Snapshots).

jankeromnes on 28 Aug 2019

👍1

Ah I see, I will still use the dockerfile for now

TheParadoxTheory on 29 Aug 2019

👀1 🎉1

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.