> so saying "it's secured in the normal docker case anyway", even if true, doesn't really help to solve the problem.
I don't think you read my comment properly. I'm saying that the security feature doesn't apply to Docker, but disabling it would be bad because it will affect other applications on the system.
> The preferred suggested fix was "mknod and chmod during image builds to be executed from outside of any chroot".
Which as I said, wouldn't be a good idea because of how chrootarchive works. In short it would lead to path traversal attacks, as with the issue you mentioned. The fix was to properly chroot things IIRC.
> A more intelligent fix would be 'require a modern/secure archive extraction tool'.
I agree. Are you willing to write a patch for it (or add patches to GNU tar?), because I'm afraid I don't have the time to do it at the moment (and I don't contribute to Docker that much these days).
> The second fallback was [...]
Which would be a bad thing to do because it would purposely disable security features that will affect other applications.
I don't think you read my comment properly. I'm saying that the security feature doesn't apply to Docker, but disabling it would be bad because it will affect other applications on the system.
> The preferred suggested fix was "mknod and chmod during image builds to be executed from outside of any chroot".
Which as I said, wouldn't be a good idea because of how chrootarchive works. In short it would lead to path traversal attacks, as with the issue you mentioned. The fix was to properly chroot things IIRC.
> A more intelligent fix would be 'require a modern/secure archive extraction tool'.
I agree. Are you willing to write a patch for it (or add patches to GNU tar?), because I'm afraid I don't have the time to do it at the moment (and I don't contribute to Docker that much these days).
> The second fallback was [...]
Which would be a bad thing to do because it would purposely disable security features that will affect other applications.