Now Docker can lead you into a little bit of a security trap.
There is a Docker group that is created alongside the installation of Docker,
and if we add users into the group,
then they have full permissions to be able to manage Docker,
which seems like a great idea,
but the problem is that it bypasses any security logging,
which would be there if we had used sudo.
So the idea is whether we use sudo or the Docker group.
If we use sudo before we run any Docker commands,
then all operations that we execute through Docker are going to be logged,
including any malicious action, so they can be more easily detected,
whereas we add users to a Docker group,
then there's no need to run the sudo command,
and the problem is, even though it's a very simple way to run Docker,
is that we are not logging any of our Docker operations.
Now, you're going to think, well, why is this such a big issue?
Well, it is possible to integrate Docker into your running operating system.
Let me show you.
As we go through and look at this command,
don't worry about the detail too much, we'll learn more as we go through,
but we're using sudo,
so it's going to be logged, docker run so we're creating an instance of
an image. ‑Ti is just going to make sure that we have a terminal and an
interactive session with the container.
We're assigning our own name; we're just calling it bad.
‑‑Privilege means then that we've got full access rights to
our container and our operating system.
The ‑v switch is making sure then that we map our root file system on our
host through to the host directory in the container.
If the host directory doesn't exist, it will be created within our container.
We're basing this upon the latest Ubuntu image,
and the command that we're running is chroot to host,
so our root directory of our container is going to be
equivalent to the root directory on our file system.
Once we're finished with this, we can remove the container, but in our demonstration, we'll show you why this is such a bad thing.