Security implications to host OS of deploying and visiting a compromised website in DDEV

[bc1121]

I migrate copies of websites to my local computer to work on locally. Some of these websites have turned out to be compromised.

Obviously it makes sense to examine these websites in isolation either on dedicated bare metal on an isolated network, or in a full virtual machine with sharing and local network access disabled. I understand VM networking better than Docker networking. I wonder how DDEV and ultimately Docker settings are setup to prevent bad guest applications from escaping from a Docker container to the Docker host.

I understand that visiting a compromised site is bad no matter where it's hosted.

How safe for the Docker host is hosting a bad site locally for examination?

[rfay]

It's a great conversation to have! In general, the answers are good, but caution is definitely in order.

• The docker architecture goes to great lengths to prevent host-escalation escapes; those are the scariest possibility.
• DDEV tries to run all containers as an unprivileged user, which helps in most cases but it's not perfect (for example, sudo is available in the web container, but it would require a double-escape for php to use it)
• The web container mounts your code from the host, and the mount is writable, so an evil entity inside the container could get an ordinary binary onto your host; but it would most likely have to be executed by you on the host.
• The traditional ddev-router image worked by mounting docker.sock into the container; this is frowned upon because it can result in an escape to host privileges, so the new traefik-based ddev-router does not do that; the traefik router is available now, but will be the default in the next major version.

Anyway, it's a great conversation and a never-ending conversation.

Don't forget that just by checking out these websites on the host you may have introduced pre-existing problems. You may want to check them before bringing them onto your computer.

[rfay]

Some thoughts for study, see google search