docker哪些命令是高危操作（Docker容器逃逸漏洞获得root权限）

漏洞概述

containerd是行业标准的容器运行时，可作为Linux和Windows的守护程序使用。在版本1.3.9和1.4.3之前的容器中，容器填充的API不正确地暴露给主机网络容器。填充程序的API套接字的访问控制验证了连接过程的有效UID为0，但没有以其他方式限制对抽象Unix域套接字的访问。这将允许在与填充程序相同的网络名称空间中运行的恶意容器（有效UID为0，但特权降低）导致新进程以提升的特权运行。

影响版本

1 containerd < 1.4.3

2 containerd < 1.3.9

环境搭建

1.Ubuntu更换源

vim /etc/apt/sources.list

#将文件内容替换为，这里为了速度快，我用了阿里的源

vim /etc/apt/sources.list #将文件内容替换为，这里为了速度快，我用了阿里的源 deb http://mirrors.aliyun.com/ubuntu/ xenial main restricted universe multiverse deb http://mirrors.aliyun.com/ubuntu/ xenial-security main restricted universe multiverse deb http://mirrors.aliyun.com/ubuntu/ xenial-updates main restricted universe multiverse deb http://mirrors.aliyun.com/ubuntu/ xenial-proposed main restricted universe multiverse deb http://mirrors.aliyun.com/ubuntu/ xenial-backports main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ xenial main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ xenial-security main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ xenial-updates main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ xenial-proposed main restricted universe multiverse deb-src http://mirrors.aliyun.com/ubuntu/ xenial-backports main restricted universe multiverse

这个是中科大 Ubuntu jammy kylin麒麟(22.04)源 deb https://mirrors.ustc.edu.cn/ubuntu/ jammy main restricted universe multiverse deb-src https://mirrors.ustc.edu.cn/ubuntu/ jammy main restricted universe multiverse deb https://mirrors.ustc.edu.cn/ubuntu/ jammy-security main restricted universe multiverse deb-src https://mirrors.ustc.edu.cn/ubuntu/ jammy-security main restricted universe multiverse deb https://mirrors.ustc.edu.cn/ubuntu/ jammy-updates main restricted universe multiverse deb-src https://mirrors.ustc.edu.cn/ubuntu/ jammy-updates main restricted universe multiverse deb https://mirrors.ustc.edu.cn/ubuntu/ jammy-backports main restricted universe multiverse deb-src https://mirrors.ustc.edu.cn/ubuntu/ jammy-backports main restricted universe multiverse

两个源选一个就可以

2.更新Ubuntu，安装所需软件包

apt-get update

先更新一下apt源

apt-get install ca-certificates curl software-properties-common

安装CA证书

3.添加官方GPG密钥

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -

如果是ubuntu22.04会报错

Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).

相信我无视这个警告，完全不影响

4.设置稳定的存储库