Codex Uses Docker Bind Mount to Bypass Sudo Restrictions

@sluongng Good. Passwordless sudo is the only sensible config

@sluongng This is why I don’t even make a user and just run as root

@sluongng Not like there is a big ass warning in the docs

https://docs.docker.com/engine/install/linux-postinstall/

@sluongng 😨 @sluongng Thats another reason to keep running podman rootlees

Thank you for sharing.

@sluongng Eerily clever 😁

@sluongng Nice. Docker requires root (or docker group membership, which is effectively root-like) by default for the daemon and many operations, which means larger risks for privilege escalation and container escapes. Podman makes more secure options the out-of-the-box experience.

you should always install rootless docker whenever possible, it can be a pain the ass but worth it. Don’t ever let an AI agent run unattended on a system that doesn’t have rootless docker setup. It’s a classic privesc vector and in my experience most LLMs will try it fairly quickly when hyper fixating on completing the task.

https://docs.docker.com/engine/security/rootless/

@sluongng The way it just casually explained what it did is scarier than the actual exploit

@sluongng That’s why everyone should default to use Podman instead of Docker.

@sluongng Training data. Stack overflow.

https://stackoverflow.com/questions/41991905/docker-root-access-to-host-system

@sluongng Another reason to use Podman. Even though Docker warns about that in the docs if my memory serves.

@sluongng @provisionalidea This is well known, and Docker’s own docs explicitly warn about it.

The solution is to use per-agent VMs, or at a minimum, run Docker in a mode where containers can’t write to your host as root.

This is not funny, this is a vulnerability. Codex generated code that bypasses security constraints. The workaround probably uses a shell trick like "chmod 777 /etc/sudoers" or runs via a subprocess that doesn't check permissions. Teams copy-paste this and wonder why their security audit fails in three months.

the part that stays with me is that the agent figured out sudo-adjacent paths from context. nobody hardcoded that workaround. it means your security model is fighting against the model's general intelligence, not against a static rule set. this gets harder, not easier, as models improve

@sluongng This is why we don't use docker

@NavinFS @sluongng The sane defaults at the OS level seem to be working. On top of that, the engineers still let people fall back on 2FA and device deregistration when their complacency catches up to them. Your OS has encryption, credentials store with biometrics and presence detection. Slop that.

@sluongng scary

@vanities @sluongng Separate LXCs per purpose on proxmox, let her rip

@NavinFS @sluongng You can link your phone to your pc so that it automatically locks when your phone is out of range of your wifi/bluetooth.

I'd call that a bug of docker. Docker encourages users and agents to give root access to normal linux users in order to use it.

This kind of bug used to be kind of ok when you'd expect few people to get into that situation "thanks" to knowledge gate keeping.

Now it's a much more widespread situation and so it should be fixed.