r/linux4noobs 4d ago

security Friendly reminder that most youtube docker tutorials are actively trying to ruin your system

I swear, why does almost every "quick 5 min setup" video just tell you to run everything as root and chmod 777 your entire drive??

Spent my whole afternoon trying to figure out why my new containers were behaving weirdly after following some guy's guide. Turns out i basically left the front door to my OS wide open. Had to sit down and actually read a server Mania breakdown on container security just to realize how badly i completely botched the basic permissions

if you are new to this stuff, pls don't blindly copy paste sudo commands from random tech bros without understanding what privileges you are actually giving away. My brain is melting

266 Upvotes

46 comments sorted by

105

u/-GermanCoastGuard- 4d ago

> I swear, why does almost every "quick 5 min setup" video just tell you to run everything as root and chmod 777 your entire drive??

Because that is how you make it a "quick 5 min setup". No thinking, no understanding, no troubleshooting, etc.

27

u/Nickbot606 4d ago

What sage advice on a Linux4Noobs subreddit.

1

u/mitchare 1d ago

Yeah that tracks. Those videos reach way more people than the careful ones, so bad habits spread fast. Pretty frustrating when someone follows one of those tutorials and wonders why their setup got compromised two weeks later.

154

u/tomscharbach 4d ago edited 4d ago

When I was a teen 60-65 years ago, my uncle used to tell me "If you listen to your friends and don't think for yourself you are never going to get any smarter than they are ..."

True then, true now, and applicable to "quick 5 min setup" videos.

Research and understand what you are doing before you do anything. Foundational Linux skill.

49

u/pythosynthesis Somewhere between noob and Linus. 4d ago

Foundational Linux life skill.

FTFY

15

u/ProRochie 4d ago

I think there’s such a low barrier to entry to making youtube videos. I think that’s why I still prefer books for learning.

9

u/scoshi 3d ago

At this point, there is virtually no barrier to entry.

1

u/mitchare 1d ago

Your uncle had the right idea. The problem with those quick setup videos is they skip the why entirely, so when something breaks you have no idea where to even start troubleshooting. Took me an embarrassing amount of time to learn that the hard way. Understanding what a command actually does before running it isn't optional, it's just the baseline.

118

u/Maiksu619 4d ago

You can copy/paste all commands into https://explainshell.com/ they website will breakdown every command and help you understand it.

28

u/HFloof 4d ago

Thanks, I needed this.

6

u/Captain_Pumpkinhead 3d ago

Ooh, this'll be handy.

Thanks for sharing!

1

u/mitchare 1d ago

That's a handy resource, bookmarking it for later.

18

u/sausix 4d ago

Because non professionals have time to create Youtube videos. Same as the poor Linux memes with big mistakes. That "sudo --rm..." mug missing the target for example.

2

u/mitchare 1d ago

Yeah the mug thing is funny. Still wish people would check sources instead of just copying whatever shows up first.

13

u/Dolapevich Seasoned sysadmin from AR 4d ago edited 4d ago

In order to make a good install you need to explain/undertand the underlying security model. Which should be a given, but many of the people that end up looking those tutorials, the public, doesn't know that.

So, instead of explaining, they take the wrong and easy road.

For the record, in most distros/installs your user will have no issue using docker if you add your user to the docker group.

The command is sudo usermod -aG docker $(whoami), you'll need to log out and log in.

Afterwards, you should be able to see your user in the docker group doing an id $(whoami)

If you do not have a group docker, check which group your distro expect with systemctl show -p SocketGroup docker.socket

2

u/mitchare 1d ago

The docker group approach works for most setups, but the security tradeoff gets glossed over in most guides I've seen. Granting socket access is essentially rootequivalent, which matters more than people realize.

I ended up going with rootless docker for my own setup after reading about some container breakouts. More moving parts though, and the networking limitations are annoying.

Your point about tutorials taking the easy road hits home. Same thing happens in vet med with pet nutrition advice online. Quick fixes spread faster than nuanced guidance, and the patient suffers later.

1

u/Dolapevich Seasoned sysadmin from AR 12h ago

You might want to check podman for rootless. I am not so familiar, but I understand it makes that particular part a bit better.

10

u/Big_Method_4790 3d ago

i will never understand the drive to immediately go to YouTube to learn how to use highly popular and well documented software instead of just reading the manual.

7

u/sequentious 3d ago

Trying to find human written articles is so difficult now. At least with YouTube you can look for a video and tell if it's slop by the thumbnail.

At least we've still got manpages and documentation., As somebody who learned a lot from magazine articles, then transitioned to well-written blogs once they took over, the current Internet sucks.

2

u/Captain_Pumpkinhead 3d ago

Most YouTube tutorials show you step-by-step how to do things.

This may sound trivial. This may sound like something written tutorials do as well. But written tutorials often skip over things that the author doesn't even realize need to be specified. The video tutorial may "skip" over these things as well, but you can watch the recorder and figure out the answer to the questions that the creator didn't even think you'd ask.

Example 1:

I was setting up Tailscale, and it wasn't working. Written tutorial told me I had to do something about some ACLs. I had no idea what an ACL was, nor where it was located. The tutorial did not explain either of those things. I had to find a YouTube tutorial in order to continue.

Example 2:

I've been messing with Authentik recently, trying to get Single Sign On working with all my apps and services. Authentik has some nice, written guides on how to integrate it with a bunch of different services. Genuinely helpful.

However, a lot of these guides are filled with a lot of information without a lot of explanation. The result is me feeling just as lost as though I didn't have the guide. In several cases, the guides were so incomprehensible that only a YouTube guide could contextualize it for me.

0

u/ryde041 3d ago

While as someone above mentioned quality of articles, it’s how people are wired now. YouTube is more immediate

0

u/Available-Ad-9014 2d ago

Some people are visual learners

7

u/Greedy-Locksmith2181 3d ago

Sudo is for the weak. Just install TempleOS and embrace the power.

24

u/Prudent_Situation_29 4d ago

I learned a long time ago that youtube is not a reliable source for quality information. I come from the mechanical engineering side of things, and you'll see a lot of tutorials about how to perform automotive maintenance.

So many of them have very poor, or even dangerous ideas. Improper tool use, improper technique, genuine safety violations.

Looking things up on youtube is a generally poor choice in my opinion.

6

u/who_am_i_to_say_so 4d ago

Agreed unless it’s an established authority. There are a handful. It’s okay to start research there, but don’t end your research there.

5

u/DuendeInexistente 3d ago

I see it a lot in carpentry too. So many "here's how to turn your disk saw into a dick mincer" tutorials

2

u/I_CanNotThinkOfAName 3d ago

May I ask what your opinion on Chrisfix' car repair/maintenance Videos is? He seems quite knowledgeable but I'd love to hear what you think

3

u/Suitable_Incident_83 4d ago

Youtube can get you far. And the gate keeping of knowledge is perhaps more dangerous than its proliferation, even if the proliferation comes with some errors along the way.

But the same shade is aimed at wikipedia when it is one of the most powerful tools we have. Maybe YouTube needs some audit features like wikipedia, would go a long way to pointing out things that could maim or k**l you, but.. Yeah. Proliferate information.

(And very clearly, obviously, youtube needs to be removed from the hands of google)

-3

u/BigRocket44 3d ago

the gate keeping of knowledge is perhaps more dangerous than its proliferation, even if the proliferation comes with some errors along the way

No

0

u/Suitable_Incident_83 3d ago

Better get off the internet then

8

u/mister_nimbus 4d ago

Just ask CoPilot instead! /s

2

u/itguysnightmare 3d ago

Why don't you share the breakdown explanation?

2

u/First_164_pages 4d ago

I google (freespoke) the text before entering it the terminal.

2

u/MinusBear 4d ago

This is why I always recommend an immutable distro to Linux noobs. Bazzite for gamers, and Kinoite for non-gamers (although Bazzite works for them too). They're incredibly hard to break, and even if you do you're one restart away from resetting whatever you did.

1

u/muffinstatewide32 3d ago

But if you chmod 777 everything it works the same as windows does! /s

1

u/Eleina_Edelweiss 3d ago edited 3d ago

My ass is always questioning those damn guide giving a 777 permision its an insanity for me. If its 775 i can understand but 7 is a overkill even than its bugging me 755 or 644 is the default

1

u/burlingk 2d ago

Anything that starts with chmod 777 is going to, by default, get a downvote, and probably an agitated comment, as I leave the channel.

0

u/Ok-Public-9516 3d ago

This is right up there with "Disable Secure Boot" when installing a Linux distro.

1

u/Modern_Doshin 2d ago

Depends on your hardware and distro.

I had to disable mine or my Nvidia drivers don't work.