Are using TestContainers safe for integration tests?

Question

I have a discussion with our DevOps about using Testcontainers for integration tests. It's a tool to bring up throw-away containers for testing. The testcontainers need a environment variable DOCKER_HOST=tcp://127.0.0.1:2375 to communicate with Docker.

He refuses to set this environment variable explaining to me that he don't want to application communicate with Docker for security reasons.

I've make a point that tool is designed to interact with Docker when running tests.

So here is my questions:

• Are there security considerations in this regard?
• What more convincing arguments can I bring?

Answer 1

I think the question about Docker security in general was already well answered in other places, for example here: https://stackoverflow.com/questions/40844197/what-is-the-docker-security-risk-of-var-run-docker-sock

In your particular instance, I see the following points:

1. The tests should run on some testing server, possibly even in a VM that is destroyed/reset after each test run, so possible accidents/incidents should not affect other systems
2. For an attacker to use this setup, they would probably (depending on your tests) need to be able to modify your test code and if they are able to do so, you will already have much bigger problems than privileged Docker access