How is sudo dangerous? Debian has an entry on Docker, which warns : Docker group membership is more dangerous than sudo That reads to me as an insinuation that sudo is itself dangerous (albeit less than Docker (group membership)). How is sudo dangerous (perhaps generally, and beyond misconfiguration)? _In particular though_ , how does _Debian_ mean here that sudo is dangerous?

Both docker and sudo can give full root access. The worst case risk of both is basically the same.

If a hacker gets full root access then recovery usually involves rebuilding your server. They can do anything and hide anything on your server.

So sudo is a lesser risk because root access can be limited by configuration. Sudo has configurable control over which commands it will execute for a user. There is also (usually) the requirement for a sudo user to enter a password which may stop some malicious attacks if a hacker gains access to that user's account; the hacker may have access but not the password.

With docker there is no such ability to configure making it "more dangerous". If you know the right "docker run" command you can get a commandline on the docker host as root. Example:


docker run -it --rm --privileged --pid=host alpine:latest nsenter -t 1 /bin/sh