"A container breakout security flaw found in the runc container runtime allows malicious containers (with minimal user interaction) to overwrite the host runc binary and gain root-level code execution on the host machine."
3
-
Why would Docker have anything to do with Salesforce?– Adrian Larson ♦Feb 12, 2019 at 19:49
-
I am not sure if Salesforce is using docker in its architecture. I saw these two links: salesforce.com/video/192749 techcrunch.com/2018/11/15/…– Greg FinzerFeb 12, 2019 at 19:55
-
1Understanding the Salesforce Architecture is probably a better resource to be looking at rather than a video talking about docker and Heroku. At any rate though, I don't really think any non-Salesforce employee is going to be able to answer this one beyond "Salesforce is a managed service, if it's a problem, it's their problem, and they will take appropriate steps. There is nothing you, personally, can do."– Derek FFeb 12, 2019 at 20:22
Add a comment
|
1 Answer
Salesforce runs on Sun Application servers, not Docker. It's primarily a blend of Java and Oracle underneath. As such, Salesforce itself is safe from this exploit. Heroku, now a salesforce.com product, may have been affected, but most likely has been updated with the patch by now (but I can't find a resource to prove this).
-
1It has been publicly stated that salesforce runs jetty as of 2014 for the servlet container (this is of course subject to change without notice) developer.salesforce.com/blogs/engineering/2014/07/… Feb 13, 2019 at 3:10
-
@ca_peterson Deep down inside, I knew that. I've seen Jetty proxy errors before. Cool bit of information to have confirmed, though.– sfdcfoxFeb 13, 2019 at 5:22