TOB-ARGO-024: Toolchain docs should link to Docker docs about not the docker group

[crenshaw-dev]

Summary

The toolchain docs say "don't use root w/ Docker," but it doesn't explain why.

Motivation

People sometimes ignore security recommendations unless they understand why the recommendations were made.

This was pointed out in item 24 of the Trail of Bits security audit. https://github.com/argoproj/argoproj/blob/master/docs/argo_security_final_report.pdf

Proposal

Link to the Docker docs explaining why running Docker as root is a bad idea.

[ahmednreldin]

Docker recommend to use non-root as a best practice without explain why
https://docs.docker.com/develop/develop-images/dockerfile_best-practices/

However, CIS explain this very well
https://www.cisecurity.org/benchmark/docker/
the Container Defense in Depth section clearly illustrates the point, which shows how a container with a mount volume can gain root access to the host,

moreover, running a containerized process as a non-root user (e.g. MySQL, Apache.etc.) offers yet another layer of secure.

[Kerwood]

The Toolchain docs states:

You should not work as root. Make your local user a member of the docker group to be able to control the Docker service on your machine.

Which refers to not running Docker commands as root, but add your user to the local docker group to avoid using sudo, eg. usermod -a -G docker <username>.

It doesn't matter if you run Docker commands with sudo or not. The Docker daemon still runs with root privileges whether you are in the docker group or not, it just saves you the sudo on every command. That's why its important to not run the container process as the root user.

https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user

The docker group grants privileges equivalent to the root user.
https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user

What @ahmednreldin is refering to is running container in privileged mode, which is something different and you shouldn't do unless you have a very explicit reason.

If anything, that phrase in the Toolchain docs, should be removed since it apparently confuses people and it's common Docker knowledge.

[crenshaw-dev]

Apologies, I completely misread the report. It's saying you should use sudo rather than adding your user to the docker group, because the latter effectively gives your user root (according to the Docker docs).

The docker group grants privileges equivalent to the root user. For details on how this impacts security in your system, see Docker Daemon Attack Surface.

[Kerwood]

Apologies, I completely misread the report. It's saying you should use sudo rather than adding your user to the docker group, because the latter effectively gives your user root (according to the Docker docs).

The docker group grants privileges equivalent to the root user. For details on how this impacts security in your system, see Docker Daemon Attack Surface.

I can't seem to find where it says that you should use sudo instead of the docker group.

The "Before you start" section is a list of tools needed to start developing on ArgoCD. How you use Docker is not a prerequisite for developing on ArgoCD. The documentation shouldn't dictate how to use Docker and it's hardly a security concern if you use sudo or the docker group. If the developer is using MacOS or Windows it's even less of a security concern, since the Docker environment is running in a virtual machine on the host.

My proposal is to remove the part which dictates on how to run Docker since it's not a prerequisite and it's confusing.

You will also need a working Docker runtime environment, to be able to build and run images. The Docker version must be fairly recent, and support multi-stage builds. You should not work as root. Make your local user a member of the docker group to be able to control the Docker service on your machine.

Multi stage build was introduced in Docker 17.05.0, so if you want to short it down a bit and be more specific, it could be rephrased to:

You will also need a working Docker runtime environment version 17.05.0 or higher.

[crenshaw-dev]

My proposal is to remove the part which dictates on how to run Docker since it's not a prerequisite and it's confusing.

Yep, I agree! Thanks for the clarifications. Opened a PR.