<story><title>Scastie: use any Scala compiler and Scala library in the browser</title><url>http://scala-lang.org/blog/2017/05/19/scastie.html</url></story><parent_chain><item><author>masgui</author><text>It does and you are root. You are evaluating inside a docker container. It&amp;#x27;s not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I&amp;#x27;m not an expert in security, if you have any advice on how we can improve our defence please tell us.</text></item><item><author>atemerev</author><text>(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile(&amp;quot;&amp;#x2F;etc&amp;#x2F;passwd&amp;quot;).getLines.mkString(&amp;quot;\n&amp;quot;) . Spoiler alert: it works!)</text></item></parent_chain><comment><author>atemerev</author><text>I am not a pentesting expert. My first reaction is to leave everything as is, as it is a very cool to play with root access to docker containers (I managed to reboot one, but a new one immediately appeared on page reload).&lt;p&gt;My worst concern now would be network security. With root access, it is trivial to e.g. install spambots in all your containers (just checked, command execution works, and external network access is enabled). I think it is a good idea to at least disable networking. (Update: and use a minimal Docker image like Alpine Linux).&lt;p&gt;Proof:&lt;p&gt;[__REDACTED__]</text></comment>
<story><title>Scastie: use any Scala compiler and Scala library in the browser</title><url>http://scala-lang.org/blog/2017/05/19/scastie.html</url></story><parent_chain><item><author>masgui</author><text>It does and you are root. You are evaluating inside a docker container. It&amp;#x27;s not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I&amp;#x27;m not an expert in security, if you have any advice on how we can improve our defence please tell us.</text></item><item><author>atemerev</author><text>(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile(&amp;quot;&amp;#x2F;etc&amp;#x2F;passwd&amp;quot;).getLines.mkString(&amp;quot;\n&amp;quot;) . Spoiler alert: it works!)</text></item></parent_chain><comment><author>clhodapp</author><text>The general rule is that you want as many layers of security as you can get away with without making things impractically inconvenient. In this case, the first step is probably &lt;i&gt;not&lt;/i&gt; letting the user&amp;#x27;s code run as root in the container. Gaining container-root is going to be the first step in many, many exploits and by letting code just run that way, you are giving a potential attacker that step for free.&lt;p&gt;Disclaimer: Absolutely not a security expert, just someone who is somewhat on the hook for security!</text></comment>