You must log in or # to comment.
I mean, there’s a big ol’ warning in the docs: https://docs.docker.com/engine/install/linux-postinstall/
The docker group grants root-level privileges to the user
But, I guess Docker doesn’t really tell you not to do this… and I feel like a lot of mac users are not used to adding sudo at the front of docker commands so… idk.
Sounds like Docker is just inherently unsecure.
In the same way that sudo is.
Sudo makes you enter your password and docker doesn’t?
Or don’t give your user docker and use sudo to use the docker CLI to get the same effect. Hell, you could even alias docker as
sudo dockerto get the same feel.Docker does by default - it only works if you use sudo. But the docs tell you to add yourself to the docker group (which requires sudo to do). Then running docker doesn’t require sudo anymore.
Yeah, that’s a terrible decision in the docs. Don’t ever add a path where anything on the shell can execute user-modifyable code as root.
As soon as you do that, you lose any protection that comes from separating root users and non-root users. Because now any malicious program can just use docker to elevate its code to root.
This is your regular reminder that docker isn’t a sandboxing solution and shouldn’t be treated as one.
TIL: uninstall docker on any machine with Claude code installed.
Or: dont let Claude code run whatever commands it wants. Read them before allowing.
I read them. I didnt understand them but I read them. It still fucked me.
That’s just letting it run any command it wants with more steps
Or: dont let Claude code run
This was known for a decade now? That’s why adding a user to docker group was always an additional step with a warning
And also why podman works the way it does
A good write-up I came across 2 months ago: “Your container is not a sandbox” https://emirb.github.io/blog/microvm-2026/
Podman for the rescue. Runs fully under current user pribileges, so no sudo or other root-privileges needed to run containers.
(Especially useful for devs who want containers but should not get sudo.)there’s just that pesky IBM thing that’s constantly hanging around in the back waiting to pull the rug you’re standing on.
It’s all open source. If they do that it will just get forked, I don’t really see the issue.
