Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Established Dockerfile for creating container for powerpwn #82

Open
wants to merge 257 commits into
base: main
Choose a base branch
from

Conversation

shanko07
Copy link
Collaborator

Created a Dockerfile which mimics the devcontainer setup. We should be able to build our own container now, distribute it and allow folks to run powerpwn from the container. Probably would be good to setup an action to publish new versions of the container to docker hub or somewhere else. Also, suggest figuring out how to not need to install from sources (mostly a problem with the puppeteer stuff I think. Had to add the --no-sandbox so this would run properly in a container that is running as root.

@shanko07
Copy link
Collaborator Author

---no-sandbox is not the most secure idea, but it seems like the risk would be based on visiting a malicious site. Since we are not building the URLs based on user input, it seems safe to do this. Best practice would be to figure out how to build and run the container as a user instead of root. This would require the python package for powerpwn to be installed in that user's home area instead of the default location. seems like more effort than worth at the moment

@mbrg
Copy link
Owner

mbrg commented Nov 18, 2024

---no-sandbox is not the most secure idea, but it seems like the risk would be based on visiting a malicious site. Since we are not building the URLs based on user input, it seems safe to do this. Best practice would be to figure out how to build and run the container as a user instead of root. This would require the python package for powerpwn to be installed in that user's home area instead of the default location. seems like more effort than worth at the moment

I'd be worried to pick and up run a "run security tool" off the internet with root prv

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants