[che-dev] Default seccomp profile for Docker containers and GDB debugger

[Oleksandr Garagatyi <ogaragat@xxxxxxxxxx>]

Hello! We have a PR that introduces an ability to customize security options of Docker containers which backs Che workspaces https://github.com/eclipse/che/pull/6856.

This PR was submitted to allow usage of GDB debugger in Che without starting containers in the privileged mode. Which is very insecure in case of shared environments.

As an option, we can turn on security profile "seccomp:unconfined" by default.

This is less secure approach than default Docker security profile but it would allow Che users use GDB debugger by default. And in an environment where this approach is not secure enough admin can set default profile in Che.env by declaring an empty value for the environment variable. 

The reasons why I'm considering this less secure approach as default are:

1. this is an approach used in k8s and OpenShift, see Mario's comment

2. UX of Che would be better by default

So, please, provide your thoughts on this topic.

--

OLEKSANDR GARAGATYI

SENIOR SOFTWARE ENGINEER

Red Hat