Proposal: document Dockerfile building security promises

Currently it seems very hard to find any documentation on what kind of security is promised by Dockerfile execution, especially if building Dockerfiles from untrusted sources.

As far as I can gather, the security is as follows:

• context directory contents are available, but there is no access to files outside it
• full access to network is available as if running an untrusted docker image
• escalating access to host is prevented with the same strength as normal untrusted docker images
• resource constraints are given in docker build command line

This means that if these limitations are acceptable, it is possible to allow building Dockerfiles from untrusted sources without creating a separate VM or similar to contain the build.

I assume something like this is already done by Docker Hub when builds are submitted to it, as it probably does not use a separate VM for each build, so the priviledge separation probably has been tested quite rigorously.

Is my assessment correct? Should this be explicitly documented somewhere?

Start by reviewing the existing documentation and Dockerfile execution security model, then verify the listed context, network, host-access, and resource-constraint claims. Done means the security promises for untrusted Dockerfile builds are confirmed and documented in an appropriate location.