GET https://kbin.spritesserver.nl/u/@sudneo@lemmy.world/hot

Response
200 OK
IP
3.21.248.81
Profiled on
Token
25cd4d

Security

Token

There is no security token.

Firewall

main Name
Security enabled
Stateless

Configuration

Key Value
provider security.user.provider.concrete.app_user_provider
context main
entry_point App\Security\KbinAuthenticator
user_checker App\Security\UserChecker
access_denied_handler (none)
access_denied_url (none)
authenticators 
[
  "two_factor"
  "remember_me"
  "App\Security\KbinAuthenticator"
  "App\Security\FacebookAuthenticator"
  "App\Security\GoogleAuthenticator"
  "App\Security\GithubAuthenticator"
  "App\Security\KeycloakAuthenticator"
]

Listeners

Listener Duration Response 
Symfony\Component\Security\Http\Firewall\ChannelListener {#723
  -map: Symfony\Component\Security\Http\AccessMap {#722 …}
  -logger: Monolog\Logger {#783 …}
  -httpPort: 80
  -httpsPort: 443
}
 0.00 ms (none) 
Symfony\Component\Security\Http\Firewall\ContextListener {#706
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage {#1017 …}
  -sessionKey: "_security_main"
  -logger: Monolog\Logger {#783 …}
  -userProviders: Symfony\Component\DependencyInjection\Argument\RewindableGenerator {#705 …}
  -dispatcher: Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher {#747 …}
  -registered: false
  -trustResolver: Scheb\TwoFactorBundle\Security\Authentication\AuthenticationTrustResolver {#780 …}
  -sessionTrackerEnabler: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage::enableUsageTracking(): void {#703 …}
}
 0.67 ms (none) 
Symfony\Component\Security\Http\Firewall\AuthenticatorManagerListener {#584
  -authenticatorManager: Symfony\Component\Security\Http\Authentication\AuthenticatorManager {#595 …}
}
 0.00 ms (none) 
Scheb\TwoFactorBundle\Security\Http\Firewall\TwoFactorAccessListener {#582
  -twoFactorFirewallConfig: Scheb\TwoFactorBundle\Security\TwoFactor\TwoFactorFirewallConfig {#842 …}
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -twoFactorAccessDecider: Scheb\TwoFactorBundle\Security\Authorization\TwoFactorAccessDecider {#581 …}
}
 0.03 ms (none) 
Symfony\Component\Security\Http\Firewall\AccessListener {#579
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -accessDecisionManager: Symfony\Component\Security\Core\Authorization\TraceableAccessDecisionManager {#937 …}
  -map: Symfony\Component\Security\Http\AccessMap {#722 …}
}
 0.00 ms (none) 
Symfony\Component\Security\Http\Firewall\LogoutListener {#786
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -options: [
    "csrf_parameter" => "_csrf_token"
    "csrf_token_id" => "logout"
    "logout_path" => "app_logout"
  ]
  -httpUtils: Symfony\Component\Security\Http\HttpUtils {#841 …}
  -csrfTokenManager: Symfony\Component\Security\Csrf\CsrfTokenManager {#1015 …}
  -eventDispatcher: Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher {#747 …}
}
 0.00 ms (none)

Authenticators

No authenticators have been recorded. Check previous profiles on your authentication endpoint.

Access Decision

affirmative Strategy
# Voter class
1 
"Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter"
2 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
3 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
4 
"Symfony\Component\Security\Core\Authorization\Voter\ExpressionVoter"
5 
"App\Security\Voter\EntryCommentVoter"
6 
"App\Security\Voter\EntryVoter"
7 
"App\Security\Voter\MagazineVoter"
8 
"App\Security\Voter\MessageThreadVoter"
9 
"App\Security\Voter\MessageVoter"
10 
"App\Security\Voter\NotificationVoter"
11 
"App\Security\Voter\OAuth2UserConsentVoter"
12 
"App\Security\Voter\PostCommentVoter"
13 
"App\Security\Voter\PostVoter"
14 
"App\Security\Voter\UserVoter"

Access decision log

# Result Attributes Object
1 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
2 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1740
  +user: Proxies\__CG__\App\Entity\User {#2372 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
  +slug: "How-do-I-create-a-docker-container-with-custom-programs"
  +title: "How do I create a docker container with custom programs inside?"
  +url: null
  +body: """
    Hello! I have a free account at hide.me and would like to try to use it with my docker compose containers. The free plan does not give me the keys for openVPN of Wireguard configuration, but only through the official client. I’d like then to create a docker container that runs the official hide.me client inside, and exposes it to other docker containers (like gluetun does, for instance). I’d also like to implement a killswitch or something like that to prevent ip leakage. Is this something easy-medium hard or something very complex? I already have a script that installs and runs the client to enable vpn that should be run at startup, but I miss the “expose the network interface” and the “do not expose it if not connected” (this last part I think is pretty easy with a basic firewall configuration)\n
    \n
    any tips/something already done?  \n
    thanks in advance!\n
    \n
    EDIT: probably crazy idea, but would it be possible to do this in gluetun?
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 11
  +favouriteCount: 30
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1728784342 {#2460
    date: 2024-10-13 03:52:22.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2140 …}
  +votes: Doctrine\ORM\PersistentCollection {#2094 …}
  +reports: Doctrine\ORM\PersistentCollection {#2090 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2327 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2328 …}
  +badges: Doctrine\ORM\PersistentCollection {#2335 …}
  +children: [
    App\Entity\EntryComment {#1741
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1740 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: null
      +root: null
      +body: "Each container, by default, runs in a separate network namespace. You can use docker CLI to create specific networks that can be shared with other containers, or use docker-compose for it. Technically, for processes outside containers you can still use the same network of that container by running the inside the network namespace of the ‘VPN’ container (for example running them with unshare). However, I wouldn’t recommend this, as containers are supposed to run mostly isolated workload and not for this kind of use-case. But yeah, technically it’s feasible."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 7
      +score: 0
      +lastActive: DateTime @1706207127 {#1717
        date: 2024-01-25 19:25:27.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@tubbadu@lemmy.kde.social"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1707 …}
      +nested: Doctrine\ORM\PersistentCollection {#2464 …}
      +votes: Doctrine\ORM\PersistentCollection {#2448 …}
      +reports: Doctrine\ORM\PersistentCollection {#2447 …}
      +favourites: Doctrine\ORM\PersistentCollection {#2462 …}
      +notifications: Doctrine\ORM\PersistentCollection {#2461 …}
      -id: 339958
      -bodyTs: "'case':89 'cli':15 'compos':31 'contain':2,26,38,48,59,73 'creat':17 'default':4 'docker':14,30 'docker-compos':29 'exampl':61 'feasibl':95 'howev':66 'insid':52 'isol':79 'kind':85 'most':78 'namespac':10,55 'network':9,19,45,54 'outsid':37 'process':36 'recommend':70 'run':5,50,62,77 'separ':8 'share':23 'specif':18 'still':41 'suppos':75 'technic':34,92 'unshar':65 'use':13,28,42,88 'use-cas':87 'vpn':58 'workload':80 'wouldn':68 'yeah':91"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/7007733"
      +editedAt: null
      +createdAt: DateTimeImmutable @1706207127 {#1739
        date: 2024-01-25 19:25:27.0 +01:00
      }
      +"title": 339958
    }
  ]
  -id: 33027
  -titleTs: "'contain':7 'creat':4 'custom':9 'docker':6 'insid':11 'program':10"
  -bodyTs: "'account':6 'advanc':153 'alreadi':98,149 'also':72 'basic':144 'client':41,56,107 'complex':96 'compos':20 'configur':35,146 'connect':133 'contain':21,50,64 'crazi':156 'creat':47 'd':43,71 'docker':19,49,63 'done':150 'easi':90,141 'easy-medium':89 'edit':154 'enabl':109 'expos':59,121,129 'firewal':145 'free':5,23 'give':27 'gluetun':66,167 'hard':92 'hello':1 'hide.me':8,55 'idea':157 'implement':75 'insid':57 'instal':103 'instanc':69 'interfac':124 'ip':84 'key':30 'killswitch':77 'last':135 'leakag':85 'like':11,44,65,73,80 'medium':91 'miss':119 'network':123 'offici':40,54 'openvpn':32 'part':136 'plan':24 'possibl':162 'pretti':140 'prevent':83 'probabl':155 'run':52,105,114 'script':101 'someth':79,88,94 'startup':116 'thank':151 'think':138 'tips/something':148 'tri':13 'use':15 'vpn':110 'wireguard':34 'would':10,159"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1706287054
  +visibility: "visible             "
  +apId: "https://lemmy.kde.social/post/722914"
  +editedAt: null
  +createdAt: DateTimeImmutable @1706200654 {#2360
    date: 2024-01-25 17:37:34.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
3 DENIED edit 
Proxies\__CG__\App\Entity\Entry {#1740
  +user: Proxies\__CG__\App\Entity\User {#2372 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
  +slug: "How-do-I-create-a-docker-container-with-custom-programs"
  +title: "How do I create a docker container with custom programs inside?"
  +url: null
  +body: """
    Hello! I have a free account at hide.me and would like to try to use it with my docker compose containers. The free plan does not give me the keys for openVPN of Wireguard configuration, but only through the official client. I’d like then to create a docker container that runs the official hide.me client inside, and exposes it to other docker containers (like gluetun does, for instance). I’d also like to implement a killswitch or something like that to prevent ip leakage. Is this something easy-medium hard or something very complex? I already have a script that installs and runs the client to enable vpn that should be run at startup, but I miss the “expose the network interface” and the “do not expose it if not connected” (this last part I think is pretty easy with a basic firewall configuration)\n
    \n
    any tips/something already done?  \n
    thanks in advance!\n
    \n
    EDIT: probably crazy idea, but would it be possible to do this in gluetun?
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 11
  +favouriteCount: 30
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1728784342 {#2460
    date: 2024-10-13 03:52:22.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2140 …}
  +votes: Doctrine\ORM\PersistentCollection {#2094 …}
  +reports: Doctrine\ORM\PersistentCollection {#2090 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2327 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2328 …}
  +badges: Doctrine\ORM\PersistentCollection {#2335 …}
  +children: [
    App\Entity\EntryComment {#1741
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1740 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: null
      +root: null
      +body: "Each container, by default, runs in a separate network namespace. You can use docker CLI to create specific networks that can be shared with other containers, or use docker-compose for it. Technically, for processes outside containers you can still use the same network of that container by running the inside the network namespace of the ‘VPN’ container (for example running them with unshare). However, I wouldn’t recommend this, as containers are supposed to run mostly isolated workload and not for this kind of use-case. But yeah, technically it’s feasible."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 7
      +score: 0
      +lastActive: DateTime @1706207127 {#1717
        date: 2024-01-25 19:25:27.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@tubbadu@lemmy.kde.social"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1707 …}
      +nested: Doctrine\ORM\PersistentCollection {#2464 …}
      +votes: Doctrine\ORM\PersistentCollection {#2448 …}
      +reports: Doctrine\ORM\PersistentCollection {#2447 …}
      +favourites: Doctrine\ORM\PersistentCollection {#2462 …}
      +notifications: Doctrine\ORM\PersistentCollection {#2461 …}
      -id: 339958
      -bodyTs: "'case':89 'cli':15 'compos':31 'contain':2,26,38,48,59,73 'creat':17 'default':4 'docker':14,30 'docker-compos':29 'exampl':61 'feasibl':95 'howev':66 'insid':52 'isol':79 'kind':85 'most':78 'namespac':10,55 'network':9,19,45,54 'outsid':37 'process':36 'recommend':70 'run':5,50,62,77 'separ':8 'share':23 'specif':18 'still':41 'suppos':75 'technic':34,92 'unshar':65 'use':13,28,42,88 'use-cas':87 'vpn':58 'workload':80 'wouldn':68 'yeah':91"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/7007733"
      +editedAt: null
      +createdAt: DateTimeImmutable @1706207127 {#1739
        date: 2024-01-25 19:25:27.0 +01:00
      }
      +"title": 339958
    }
  ]
  -id: 33027
  -titleTs: "'contain':7 'creat':4 'custom':9 'docker':6 'insid':11 'program':10"
  -bodyTs: "'account':6 'advanc':153 'alreadi':98,149 'also':72 'basic':144 'client':41,56,107 'complex':96 'compos':20 'configur':35,146 'connect':133 'contain':21,50,64 'crazi':156 'creat':47 'd':43,71 'docker':19,49,63 'done':150 'easi':90,141 'easy-medium':89 'edit':154 'enabl':109 'expos':59,121,129 'firewal':145 'free':5,23 'give':27 'gluetun':66,167 'hard':92 'hello':1 'hide.me':8,55 'idea':157 'implement':75 'insid':57 'instal':103 'instanc':69 'interfac':124 'ip':84 'key':30 'killswitch':77 'last':135 'leakag':85 'like':11,44,65,73,80 'medium':91 'miss':119 'network':123 'offici':40,54 'openvpn':32 'part':136 'plan':24 'possibl':162 'pretti':140 'prevent':83 'probabl':155 'run':52,105,114 'script':101 'someth':79,88,94 'startup':116 'thank':151 'think':138 'tips/something':148 'tri':13 'use':15 'vpn':110 'wireguard':34 'would':10,159"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1706287054
  +visibility: "visible             "
  +apId: "https://lemmy.kde.social/post/722914"
  +editedAt: null
  +createdAt: DateTimeImmutable @1706200654 {#2360
    date: 2024-01-25 17:37:34.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
4 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1740
  +user: Proxies\__CG__\App\Entity\User {#2372 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
  +slug: "How-do-I-create-a-docker-container-with-custom-programs"
  +title: "How do I create a docker container with custom programs inside?"
  +url: null
  +body: """
    Hello! I have a free account at hide.me and would like to try to use it with my docker compose containers. The free plan does not give me the keys for openVPN of Wireguard configuration, but only through the official client. I’d like then to create a docker container that runs the official hide.me client inside, and exposes it to other docker containers (like gluetun does, for instance). I’d also like to implement a killswitch or something like that to prevent ip leakage. Is this something easy-medium hard or something very complex? I already have a script that installs and runs the client to enable vpn that should be run at startup, but I miss the “expose the network interface” and the “do not expose it if not connected” (this last part I think is pretty easy with a basic firewall configuration)\n
    \n
    any tips/something already done?  \n
    thanks in advance!\n
    \n
    EDIT: probably crazy idea, but would it be possible to do this in gluetun?
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 11
  +favouriteCount: 30
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1728784342 {#2460
    date: 2024-10-13 03:52:22.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2140 …}
  +votes: Doctrine\ORM\PersistentCollection {#2094 …}
  +reports: Doctrine\ORM\PersistentCollection {#2090 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2327 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2328 …}
  +badges: Doctrine\ORM\PersistentCollection {#2335 …}
  +children: [
    App\Entity\EntryComment {#1741
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1740 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: null
      +root: null
      +body: "Each container, by default, runs in a separate network namespace. You can use docker CLI to create specific networks that can be shared with other containers, or use docker-compose for it. Technically, for processes outside containers you can still use the same network of that container by running the inside the network namespace of the ‘VPN’ container (for example running them with unshare). However, I wouldn’t recommend this, as containers are supposed to run mostly isolated workload and not for this kind of use-case. But yeah, technically it’s feasible."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 7
      +score: 0
      +lastActive: DateTime @1706207127 {#1717
        date: 2024-01-25 19:25:27.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@tubbadu@lemmy.kde.social"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1707 …}
      +nested: Doctrine\ORM\PersistentCollection {#2464 …}
      +votes: Doctrine\ORM\PersistentCollection {#2448 …}
      +reports: Doctrine\ORM\PersistentCollection {#2447 …}
      +favourites: Doctrine\ORM\PersistentCollection {#2462 …}
      +notifications: Doctrine\ORM\PersistentCollection {#2461 …}
      -id: 339958
      -bodyTs: "'case':89 'cli':15 'compos':31 'contain':2,26,38,48,59,73 'creat':17 'default':4 'docker':14,30 'docker-compos':29 'exampl':61 'feasibl':95 'howev':66 'insid':52 'isol':79 'kind':85 'most':78 'namespac':10,55 'network':9,19,45,54 'outsid':37 'process':36 'recommend':70 'run':5,50,62,77 'separ':8 'share':23 'specif':18 'still':41 'suppos':75 'technic':34,92 'unshar':65 'use':13,28,42,88 'use-cas':87 'vpn':58 'workload':80 'wouldn':68 'yeah':91"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/7007733"
      +editedAt: null
      +createdAt: DateTimeImmutable @1706207127 {#1739
        date: 2024-01-25 19:25:27.0 +01:00
      }
      +"title": 339958
    }
  ]
  -id: 33027
  -titleTs: "'contain':7 'creat':4 'custom':9 'docker':6 'insid':11 'program':10"
  -bodyTs: "'account':6 'advanc':153 'alreadi':98,149 'also':72 'basic':144 'client':41,56,107 'complex':96 'compos':20 'configur':35,146 'connect':133 'contain':21,50,64 'crazi':156 'creat':47 'd':43,71 'docker':19,49,63 'done':150 'easi':90,141 'easy-medium':89 'edit':154 'enabl':109 'expos':59,121,129 'firewal':145 'free':5,23 'give':27 'gluetun':66,167 'hard':92 'hello':1 'hide.me':8,55 'idea':157 'implement':75 'insid':57 'instal':103 'instanc':69 'interfac':124 'ip':84 'key':30 'killswitch':77 'last':135 'leakag':85 'like':11,44,65,73,80 'medium':91 'miss':119 'network':123 'offici':40,54 'openvpn':32 'part':136 'plan':24 'possibl':162 'pretti':140 'prevent':83 'probabl':155 'run':52,105,114 'script':101 'someth':79,88,94 'startup':116 'thank':151 'think':138 'tips/something':148 'tri':13 'use':15 'vpn':110 'wireguard':34 'would':10,159"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1706287054
  +visibility: "visible             "
  +apId: "https://lemmy.kde.social/post/722914"
  +editedAt: null
  +createdAt: DateTimeImmutable @1706200654 {#2360
    date: 2024-01-25 17:37:34.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
5 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
6 DENIED moderate 
App\Entity\EntryComment {#1741
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1740
    +user: Proxies\__CG__\App\Entity\User {#2372 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
    +slug: "How-do-I-create-a-docker-container-with-custom-programs"
    +title: "How do I create a docker container with custom programs inside?"
    +url: null
    +body: """
      Hello! I have a free account at hide.me and would like to try to use it with my docker compose containers. The free plan does not give me the keys for openVPN of Wireguard configuration, but only through the official client. I’d like then to create a docker container that runs the official hide.me client inside, and exposes it to other docker containers (like gluetun does, for instance). I’d also like to implement a killswitch or something like that to prevent ip leakage. Is this something easy-medium hard or something very complex? I already have a script that installs and runs the client to enable vpn that should be run at startup, but I miss the “expose the network interface” and the “do not expose it if not connected” (this last part I think is pretty easy with a basic firewall configuration)\n
      \n
      any tips/something already done?  \n
      thanks in advance!\n
      \n
      EDIT: probably crazy idea, but would it be possible to do this in gluetun?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 11
    +favouriteCount: 30
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1728784342 {#2460
      date: 2024-10-13 03:52:22.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2140 …}
    +votes: Doctrine\ORM\PersistentCollection {#2094 …}
    +reports: Doctrine\ORM\PersistentCollection {#2090 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2327 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2328 …}
    +badges: Doctrine\ORM\PersistentCollection {#2335 …}
    +children: [
      App\Entity\EntryComment {#1741}
    ]
    -id: 33027
    -titleTs: "'contain':7 'creat':4 'custom':9 'docker':6 'insid':11 'program':10"
    -bodyTs: "'account':6 'advanc':153 'alreadi':98,149 'also':72 'basic':144 'client':41,56,107 'complex':96 'compos':20 'configur':35,146 'connect':133 'contain':21,50,64 'crazi':156 'creat':47 'd':43,71 'docker':19,49,63 'done':150 'easi':90,141 'easy-medium':89 'edit':154 'enabl':109 'expos':59,121,129 'firewal':145 'free':5,23 'give':27 'gluetun':66,167 'hard':92 'hello':1 'hide.me':8,55 'idea':157 'implement':75 'insid':57 'instal':103 'instanc':69 'interfac':124 'ip':84 'key':30 'killswitch':77 'last':135 'leakag':85 'like':11,44,65,73,80 'medium':91 'miss':119 'network':123 'offici':40,54 'openvpn':32 'part':136 'plan':24 'possibl':162 'pretti':140 'prevent':83 'probabl':155 'run':52,105,114 'script':101 'someth':79,88,94 'startup':116 'thank':151 'think':138 'tips/something':148 'tri':13 'use':15 'vpn':110 'wireguard':34 'would':10,159"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1706287054
    +visibility: "visible             "
    +apId: "https://lemmy.kde.social/post/722914"
    +editedAt: null
    +createdAt: DateTimeImmutable @1706200654 {#2360
      date: 2024-01-25 17:37:34.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: null
  +root: null
  +body: "Each container, by default, runs in a separate network namespace. You can use docker CLI to create specific networks that can be shared with other containers, or use docker-compose for it. Technically, for processes outside containers you can still use the same network of that container by running the inside the network namespace of the ‘VPN’ container (for example running them with unshare). However, I wouldn’t recommend this, as containers are supposed to run mostly isolated workload and not for this kind of use-case. But yeah, technically it’s feasible."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 7
  +score: 0
  +lastActive: DateTime @1706207127 {#1717
    date: 2024-01-25 19:25:27.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@tubbadu@lemmy.kde.social"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1707 …}
  +nested: Doctrine\ORM\PersistentCollection {#2464 …}
  +votes: Doctrine\ORM\PersistentCollection {#2448 …}
  +reports: Doctrine\ORM\PersistentCollection {#2447 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2462 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2461 …}
  -id: 339958
  -bodyTs: "'case':89 'cli':15 'compos':31 'contain':2,26,38,48,59,73 'creat':17 'default':4 'docker':14,30 'docker-compos':29 'exampl':61 'feasibl':95 'howev':66 'insid':52 'isol':79 'kind':85 'most':78 'namespac':10,55 'network':9,19,45,54 'outsid':37 'process':36 'recommend':70 'run':5,50,62,77 'separ':8 'share':23 'specif':18 'still':41 'suppos':75 'technic':34,92 'unshar':65 'use':13,28,42,88 'use-cas':87 'vpn':58 'workload':80 'wouldn':68 'yeah':91"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/7007733"
  +editedAt: null
  +createdAt: DateTimeImmutable @1706207127 {#1739
    date: 2024-01-25 19:25:27.0 +01:00
  }
  +"title": 339958
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
7 DENIED edit 
App\Entity\EntryComment {#1741
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1740
    +user: Proxies\__CG__\App\Entity\User {#2372 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
    +slug: "How-do-I-create-a-docker-container-with-custom-programs"
    +title: "How do I create a docker container with custom programs inside?"
    +url: null
    +body: """
      Hello! I have a free account at hide.me and would like to try to use it with my docker compose containers. The free plan does not give me the keys for openVPN of Wireguard configuration, but only through the official client. I’d like then to create a docker container that runs the official hide.me client inside, and exposes it to other docker containers (like gluetun does, for instance). I’d also like to implement a killswitch or something like that to prevent ip leakage. Is this something easy-medium hard or something very complex? I already have a script that installs and runs the client to enable vpn that should be run at startup, but I miss the “expose the network interface” and the “do not expose it if not connected” (this last part I think is pretty easy with a basic firewall configuration)\n
      \n
      any tips/something already done?  \n
      thanks in advance!\n
      \n
      EDIT: probably crazy idea, but would it be possible to do this in gluetun?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 11
    +favouriteCount: 30
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1728784342 {#2460
      date: 2024-10-13 03:52:22.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2140 …}
    +votes: Doctrine\ORM\PersistentCollection {#2094 …}
    +reports: Doctrine\ORM\PersistentCollection {#2090 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2327 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2328 …}
    +badges: Doctrine\ORM\PersistentCollection {#2335 …}
    +children: [
      App\Entity\EntryComment {#1741}
    ]
    -id: 33027
    -titleTs: "'contain':7 'creat':4 'custom':9 'docker':6 'insid':11 'program':10"
    -bodyTs: "'account':6 'advanc':153 'alreadi':98,149 'also':72 'basic':144 'client':41,56,107 'complex':96 'compos':20 'configur':35,146 'connect':133 'contain':21,50,64 'crazi':156 'creat':47 'd':43,71 'docker':19,49,63 'done':150 'easi':90,141 'easy-medium':89 'edit':154 'enabl':109 'expos':59,121,129 'firewal':145 'free':5,23 'give':27 'gluetun':66,167 'hard':92 'hello':1 'hide.me':8,55 'idea':157 'implement':75 'insid':57 'instal':103 'instanc':69 'interfac':124 'ip':84 'key':30 'killswitch':77 'last':135 'leakag':85 'like':11,44,65,73,80 'medium':91 'miss':119 'network':123 'offici':40,54 'openvpn':32 'part':136 'plan':24 'possibl':162 'pretti':140 'prevent':83 'probabl':155 'run':52,105,114 'script':101 'someth':79,88,94 'startup':116 'thank':151 'think':138 'tips/something':148 'tri':13 'use':15 'vpn':110 'wireguard':34 'would':10,159"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1706287054
    +visibility: "visible             "
    +apId: "https://lemmy.kde.social/post/722914"
    +editedAt: null
    +createdAt: DateTimeImmutable @1706200654 {#2360
      date: 2024-01-25 17:37:34.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: null
  +root: null
  +body: "Each container, by default, runs in a separate network namespace. You can use docker CLI to create specific networks that can be shared with other containers, or use docker-compose for it. Technically, for processes outside containers you can still use the same network of that container by running the inside the network namespace of the ‘VPN’ container (for example running them with unshare). However, I wouldn’t recommend this, as containers are supposed to run mostly isolated workload and not for this kind of use-case. But yeah, technically it’s feasible."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 7
  +score: 0
  +lastActive: DateTime @1706207127 {#1717
    date: 2024-01-25 19:25:27.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@tubbadu@lemmy.kde.social"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1707 …}
  +nested: Doctrine\ORM\PersistentCollection {#2464 …}
  +votes: Doctrine\ORM\PersistentCollection {#2448 …}
  +reports: Doctrine\ORM\PersistentCollection {#2447 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2462 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2461 …}
  -id: 339958
  -bodyTs: "'case':89 'cli':15 'compos':31 'contain':2,26,38,48,59,73 'creat':17 'default':4 'docker':14,30 'docker-compos':29 'exampl':61 'feasibl':95 'howev':66 'insid':52 'isol':79 'kind':85 'most':78 'namespac':10,55 'network':9,19,45,54 'outsid':37 'process':36 'recommend':70 'run':5,50,62,77 'separ':8 'share':23 'specif':18 'still':41 'suppos':75 'technic':34,92 'unshar':65 'use':13,28,42,88 'use-cas':87 'vpn':58 'workload':80 'wouldn':68 'yeah':91"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/7007733"
  +editedAt: null
  +createdAt: DateTimeImmutable @1706207127 {#1739
    date: 2024-01-25 19:25:27.0 +01:00
  }
  +"title": 339958
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
8 DENIED moderate 
App\Entity\EntryComment {#1741
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1740
    +user: Proxies\__CG__\App\Entity\User {#2372 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
    +slug: "How-do-I-create-a-docker-container-with-custom-programs"
    +title: "How do I create a docker container with custom programs inside?"
    +url: null
    +body: """
      Hello! I have a free account at hide.me and would like to try to use it with my docker compose containers. The free plan does not give me the keys for openVPN of Wireguard configuration, but only through the official client. I’d like then to create a docker container that runs the official hide.me client inside, and exposes it to other docker containers (like gluetun does, for instance). I’d also like to implement a killswitch or something like that to prevent ip leakage. Is this something easy-medium hard or something very complex? I already have a script that installs and runs the client to enable vpn that should be run at startup, but I miss the “expose the network interface” and the “do not expose it if not connected” (this last part I think is pretty easy with a basic firewall configuration)\n
      \n
      any tips/something already done?  \n
      thanks in advance!\n
      \n
      EDIT: probably crazy idea, but would it be possible to do this in gluetun?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 11
    +favouriteCount: 30
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1728784342 {#2460
      date: 2024-10-13 03:52:22.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2140 …}
    +votes: Doctrine\ORM\PersistentCollection {#2094 …}
    +reports: Doctrine\ORM\PersistentCollection {#2090 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2327 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2328 …}
    +badges: Doctrine\ORM\PersistentCollection {#2335 …}
    +children: [
      App\Entity\EntryComment {#1741}
    ]
    -id: 33027
    -titleTs: "'contain':7 'creat':4 'custom':9 'docker':6 'insid':11 'program':10"
    -bodyTs: "'account':6 'advanc':153 'alreadi':98,149 'also':72 'basic':144 'client':41,56,107 'complex':96 'compos':20 'configur':35,146 'connect':133 'contain':21,50,64 'crazi':156 'creat':47 'd':43,71 'docker':19,49,63 'done':150 'easi':90,141 'easy-medium':89 'edit':154 'enabl':109 'expos':59,121,129 'firewal':145 'free':5,23 'give':27 'gluetun':66,167 'hard':92 'hello':1 'hide.me':8,55 'idea':157 'implement':75 'insid':57 'instal':103 'instanc':69 'interfac':124 'ip':84 'key':30 'killswitch':77 'last':135 'leakag':85 'like':11,44,65,73,80 'medium':91 'miss':119 'network':123 'offici':40,54 'openvpn':32 'part':136 'plan':24 'possibl':162 'pretti':140 'prevent':83 'probabl':155 'run':52,105,114 'script':101 'someth':79,88,94 'startup':116 'thank':151 'think':138 'tips/something':148 'tri':13 'use':15 'vpn':110 'wireguard':34 'would':10,159"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1706287054
    +visibility: "visible             "
    +apId: "https://lemmy.kde.social/post/722914"
    +editedAt: null
    +createdAt: DateTimeImmutable @1706200654 {#2360
      date: 2024-01-25 17:37:34.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: null
  +root: null
  +body: "Each container, by default, runs in a separate network namespace. You can use docker CLI to create specific networks that can be shared with other containers, or use docker-compose for it. Technically, for processes outside containers you can still use the same network of that container by running the inside the network namespace of the ‘VPN’ container (for example running them with unshare). However, I wouldn’t recommend this, as containers are supposed to run mostly isolated workload and not for this kind of use-case. But yeah, technically it’s feasible."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 7
  +score: 0
  +lastActive: DateTime @1706207127 {#1717
    date: 2024-01-25 19:25:27.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@tubbadu@lemmy.kde.social"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1707 …}
  +nested: Doctrine\ORM\PersistentCollection {#2464 …}
  +votes: Doctrine\ORM\PersistentCollection {#2448 …}
  +reports: Doctrine\ORM\PersistentCollection {#2447 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2462 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2461 …}
  -id: 339958
  -bodyTs: "'case':89 'cli':15 'compos':31 'contain':2,26,38,48,59,73 'creat':17 'default':4 'docker':14,30 'docker-compos':29 'exampl':61 'feasibl':95 'howev':66 'insid':52 'isol':79 'kind':85 'most':78 'namespac':10,55 'network':9,19,45,54 'outsid':37 'process':36 'recommend':70 'run':5,50,62,77 'separ':8 'share':23 'specif':18 'still':41 'suppos':75 'technic':34,92 'unshar':65 'use':13,28,42,88 'use-cas':87 'vpn':58 'workload':80 'wouldn':68 'yeah':91"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/7007733"
  +editedAt: null
  +createdAt: DateTimeImmutable @1706207127 {#1739
    date: 2024-01-25 19:25:27.0 +01:00
  }
  +"title": 339958
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
9 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
10 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1626
  +user: Proxies\__CG__\App\Entity\User {#2338 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
  +slug: "How-to-secure-podman-or-docker-containers-for-public-facing-hosting"
  +title: "How to secure (podman or docker) containers for public-facing hosting?"
  +url: null
  +body: """
    Context\n
    -------\n
    \n
    I want to host public-facing applications on a server in my home, without compromising security. I realize containers might be one way to do this, and want to explore that route further.\n
    \n
    Requirements\n
    ------------\n
    \n
    I want to run applications within containers such that they\n
    \n
    - Must not be able to interfere with applications running on host\n
    - Must not be able to interfere with other containers or applications inside them\n
    - Must have no access or influence on other devices in the local network, or otherwise compromise the security of the network, but still accessible by devices via ssh.\n
    \n
    > Note: all of this within reason. I understand that sometimes there may be occasional vulnerabilities, like in kernel for example, that would eventually get fixed. Risks like this within reason I am willing to accept.\n
    \n
    What I found so far\n
    -------------------\n
    \n
    - **Running containers in rootless mode:** in other words, running the container daemon with an unprivileged host user\n
    - **Running applications in container under unprivileged users:** the container user under which the container is ran should be unprivileged\n
    - **Networking:** The container’s networking must be restricted. I am still not sure how to do this and shall explore it more, but would appreciate any resources.\n
    \n
    Alternative solution\n
    --------------------\n
    \n
    I have seen bubblewrap presented as an alternative, but it seems like it is not intended to be used directly in this manner, and information about using it for this is scarce.
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 21
  +favouriteCount: 83
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1719138740 {#2337
    date: 2024-06-23 12:32:20.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2159 …}
  +votes: Doctrine\ORM\PersistentCollection {#2074 …}
  +reports: Doctrine\ORM\PersistentCollection {#2071 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2070 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2048 …}
  +badges: Doctrine\ORM\PersistentCollection {#2056 …}
  +children: [
    1 => App\Entity\EntryComment {#1628
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: null
      +root: null
      +body: """
        You already mentioned the most important things.\n
        \n
        I will add, at the cost of being pedantic:\n
        \n
        - build the image properly, or use good images. This means limit dependencies as much as possible, as minimal images as possible (less updates due to CVEs, less tooling).\n
        - do not mount host volumes, if you really have to, use a dedicated subpath owned by the user of the container. Do not use homedirs etc.\n
        - do not run in host namespaces, like host network etc. Use port mapping to send traffic to the container.\n
        \n
        If you want to go hardcore:\n
        \n
        - analyze your application, and if feasible, build and use a more restrictive seccomp profile compared to the default. This might limit additional syscalls that might be used during an exploitation but that your app doesn’t need.\n
        - run falco on the node. Even with the default set of rules (nothing custom), many exploitation or posts-exploitation steps would be caught, such as “shell spawned” etc.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 6
      +score: 0
      +lastActive: DateTime @1719122506 {#1630
        date: 2024-06-23 08:01:46.0 +02:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@cyclohexane@lemmy.ml"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1599 …}
      +nested: Doctrine\ORM\PersistentCollection {#1625 …}
      +votes: Doctrine\ORM\PersistentCollection {#1617 …}
      +reports: Doctrine\ORM\PersistentCollection {#1725 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1722 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1726 …}
      -id: 288266
      -bodyTs: "'add':10 'addit':117 'alreadi':2 'analyz':96 'app':129 'applic':98 'build':17,102 'caught':156 'compar':110 'contain':65,89 'cost':13 'custom':146 'cves':42 'dedic':57 'default':113,141 'depend':28 'doesn':130 'due':40 'etc':70,80,161 'even':138 'exploit':125,148,152 'falco':134 'feasibl':101 'go':94 'good':23 'hardcor':95 'homedir':69 'host':48,75,78 'imag':19,24,35 'import':6 'less':38,43 'like':77 'limit':27,116 'mani':147 'map':83 'mean':26 'mention':3 'might':115,120 'minim':34 'mount':47 'much':30 'namespac':76 'need':132 'network':79 'node':137 'noth':145 'own':59 'pedant':16 'port':82 'possibl':32,37 'post':151 'posts-exploit':150 'profil':109 'proper':20 'realli':52 'restrict':107 'rule':144 'run':73,133 'seccomp':108 'send':85 'set':142 'shell':159 'spawn':160 'step':153 'subpath':58 'syscal':118 'thing':7 'tool':44 'traffic':86 'updat':39 'use':22,55,68,81,104,122 'user':62 'volum':49 'want':92 'would':154"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6473668"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704620762 {#1629
        date: 2024-01-07 10:46:02.0 +01:00
      }
      +"title": 288266
    }
    0 => App\Entity\EntryComment {#1737
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1734 …}
      +root: App\Entity\EntryComment {#1628}
      +body: "It’s the de-facto standard for runtime container security (sysdig is based on it). The only competitor afaik is aqua security’s tracee, which is way less mature. It is very well supporter, there are tons of rules maintained by the community and it is a CNCF project used by enterprise solutions (I.e., shouldn’t disappear overnight)."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 1
      +score: 0
      +lastActive: DateTime @1704690575 {#1736
        date: 2024-01-08 06:09:35.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@cyclohexane@lemmy.ml"
        "@sudneo@lemmy.world"
        "@krash@lemmy.ml"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1732 …}
      +nested: Doctrine\ORM\PersistentCollection {#1735 …}
      +votes: Doctrine\ORM\PersistentCollection {#1729 …}
      +reports: Doctrine\ORM\PersistentCollection {#1719 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1714 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1720 …}
      -id: 290565
      -bodyTs: "'afaik':20 'aqua':22 'base':14 'cncf':49 'communiti':44 'competitor':19 'contain':10 'de':5 'de-facto':4 'disappear':58 'enterpris':53 'facto':6 'i.e':55 'less':29 'maintain':41 'matur':30 'overnight':59 'project':50 'rule':40 'runtim':9 'secur':11,23 'shouldn':56 'solut':54 'standard':7 'support':35 'sysdig':12 'ton':38 'trace':25 'use':51 'way':28 'well':34"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6491825"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704690575 {#1730
        date: 2024-01-08 06:09:35.0 +01:00
      }
      +"title": 290565
    }
  ]
  -id: 27753
  -titleTs: "'contain':7 'docker':6 'face':11 'host':12 'podman':4 'public':10 'public-fac':9 'secur':3"
  -bodyTs: "'abl':50,61 'accept':133 'access':74,94 'altern':202,211 'applic':9,41,54,68,157 'appreci':199 'bubblewrap':207 'compromis':17,86 'contain':21,43,66,140,149,159,164,169,177 'context':1 'daemon':150 'devic':79,96 'direct':223 'eventu':121 'exampl':118 'explor':32,194 'face':8 'far':138 'fix':123 'found':136 'get':122 'home':15 'host':5,57,154 'influenc':76 'inform':228 'insid':69 'intend':219 'interfer':52,63 'kernel':116 'like':114,125,215 'local':82 'manner':226 'may':110 'might':22 'mode':143 'must':47,58,71,180 'network':83,91,175,179 'note':99 'occasion':112 'one':24 'otherwis':85 'present':208 'public':7 'public-fac':6 'ran':171 'realiz':20 'reason':104,128 'requir':36 'resourc':201 'restrict':182 'risk':124 'rootless':142 'rout':34 'run':40,55,139,147,156 'scarc':235 'secur':18,88 'seem':214 'seen':206 'server':12 'shall':193 'solut':203 'sometim':108 'ssh':98 'still':93,185 'sure':187 'understand':106 'unprivileg':153,161,174 'use':222,230 'user':155,162,165 'via':97 'vulner':113 'want':3,30,38 'way':25 'will':131 'within':42,103,127 'without':16 'word':146 'would':120,198"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1704677667
  +visibility: "visible             "
  +apId: "https://lemmy.ml/post/10216078"
  +editedAt: DateTimeImmutable @1712598393 {#2079
    date: 2024-04-08 19:46:33.0 +02:00
  }
  +createdAt: DateTimeImmutable @1704591267 {#2062
    date: 2024-01-07 02:34:27.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
11 DENIED edit 
Proxies\__CG__\App\Entity\Entry {#1626
  +user: Proxies\__CG__\App\Entity\User {#2338 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
  +slug: "How-to-secure-podman-or-docker-containers-for-public-facing-hosting"
  +title: "How to secure (podman or docker) containers for public-facing hosting?"
  +url: null
  +body: """
    Context\n
    -------\n
    \n
    I want to host public-facing applications on a server in my home, without compromising security. I realize containers might be one way to do this, and want to explore that route further.\n
    \n
    Requirements\n
    ------------\n
    \n
    I want to run applications within containers such that they\n
    \n
    - Must not be able to interfere with applications running on host\n
    - Must not be able to interfere with other containers or applications inside them\n
    - Must have no access or influence on other devices in the local network, or otherwise compromise the security of the network, but still accessible by devices via ssh.\n
    \n
    > Note: all of this within reason. I understand that sometimes there may be occasional vulnerabilities, like in kernel for example, that would eventually get fixed. Risks like this within reason I am willing to accept.\n
    \n
    What I found so far\n
    -------------------\n
    \n
    - **Running containers in rootless mode:** in other words, running the container daemon with an unprivileged host user\n
    - **Running applications in container under unprivileged users:** the container user under which the container is ran should be unprivileged\n
    - **Networking:** The container’s networking must be restricted. I am still not sure how to do this and shall explore it more, but would appreciate any resources.\n
    \n
    Alternative solution\n
    --------------------\n
    \n
    I have seen bubblewrap presented as an alternative, but it seems like it is not intended to be used directly in this manner, and information about using it for this is scarce.
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 21
  +favouriteCount: 83
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1719138740 {#2337
    date: 2024-06-23 12:32:20.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2159 …}
  +votes: Doctrine\ORM\PersistentCollection {#2074 …}
  +reports: Doctrine\ORM\PersistentCollection {#2071 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2070 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2048 …}
  +badges: Doctrine\ORM\PersistentCollection {#2056 …}
  +children: [
    1 => App\Entity\EntryComment {#1628
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: null
      +root: null
      +body: """
        You already mentioned the most important things.\n
        \n
        I will add, at the cost of being pedantic:\n
        \n
        - build the image properly, or use good images. This means limit dependencies as much as possible, as minimal images as possible (less updates due to CVEs, less tooling).\n
        - do not mount host volumes, if you really have to, use a dedicated subpath owned by the user of the container. Do not use homedirs etc.\n
        - do not run in host namespaces, like host network etc. Use port mapping to send traffic to the container.\n
        \n
        If you want to go hardcore:\n
        \n
        - analyze your application, and if feasible, build and use a more restrictive seccomp profile compared to the default. This might limit additional syscalls that might be used during an exploitation but that your app doesn’t need.\n
        - run falco on the node. Even with the default set of rules (nothing custom), many exploitation or posts-exploitation steps would be caught, such as “shell spawned” etc.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 6
      +score: 0
      +lastActive: DateTime @1719122506 {#1630
        date: 2024-06-23 08:01:46.0 +02:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@cyclohexane@lemmy.ml"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1599 …}
      +nested: Doctrine\ORM\PersistentCollection {#1625 …}
      +votes: Doctrine\ORM\PersistentCollection {#1617 …}
      +reports: Doctrine\ORM\PersistentCollection {#1725 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1722 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1726 …}
      -id: 288266
      -bodyTs: "'add':10 'addit':117 'alreadi':2 'analyz':96 'app':129 'applic':98 'build':17,102 'caught':156 'compar':110 'contain':65,89 'cost':13 'custom':146 'cves':42 'dedic':57 'default':113,141 'depend':28 'doesn':130 'due':40 'etc':70,80,161 'even':138 'exploit':125,148,152 'falco':134 'feasibl':101 'go':94 'good':23 'hardcor':95 'homedir':69 'host':48,75,78 'imag':19,24,35 'import':6 'less':38,43 'like':77 'limit':27,116 'mani':147 'map':83 'mean':26 'mention':3 'might':115,120 'minim':34 'mount':47 'much':30 'namespac':76 'need':132 'network':79 'node':137 'noth':145 'own':59 'pedant':16 'port':82 'possibl':32,37 'post':151 'posts-exploit':150 'profil':109 'proper':20 'realli':52 'restrict':107 'rule':144 'run':73,133 'seccomp':108 'send':85 'set':142 'shell':159 'spawn':160 'step':153 'subpath':58 'syscal':118 'thing':7 'tool':44 'traffic':86 'updat':39 'use':22,55,68,81,104,122 'user':62 'volum':49 'want':92 'would':154"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6473668"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704620762 {#1629
        date: 2024-01-07 10:46:02.0 +01:00
      }
      +"title": 288266
    }
    0 => App\Entity\EntryComment {#1737
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1734 …}
      +root: App\Entity\EntryComment {#1628}
      +body: "It’s the de-facto standard for runtime container security (sysdig is based on it). The only competitor afaik is aqua security’s tracee, which is way less mature. It is very well supporter, there are tons of rules maintained by the community and it is a CNCF project used by enterprise solutions (I.e., shouldn’t disappear overnight)."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 1
      +score: 0
      +lastActive: DateTime @1704690575 {#1736
        date: 2024-01-08 06:09:35.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@cyclohexane@lemmy.ml"
        "@sudneo@lemmy.world"
        "@krash@lemmy.ml"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1732 …}
      +nested: Doctrine\ORM\PersistentCollection {#1735 …}
      +votes: Doctrine\ORM\PersistentCollection {#1729 …}
      +reports: Doctrine\ORM\PersistentCollection {#1719 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1714 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1720 …}
      -id: 290565
      -bodyTs: "'afaik':20 'aqua':22 'base':14 'cncf':49 'communiti':44 'competitor':19 'contain':10 'de':5 'de-facto':4 'disappear':58 'enterpris':53 'facto':6 'i.e':55 'less':29 'maintain':41 'matur':30 'overnight':59 'project':50 'rule':40 'runtim':9 'secur':11,23 'shouldn':56 'solut':54 'standard':7 'support':35 'sysdig':12 'ton':38 'trace':25 'use':51 'way':28 'well':34"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6491825"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704690575 {#1730
        date: 2024-01-08 06:09:35.0 +01:00
      }
      +"title": 290565
    }
  ]
  -id: 27753
  -titleTs: "'contain':7 'docker':6 'face':11 'host':12 'podman':4 'public':10 'public-fac':9 'secur':3"
  -bodyTs: "'abl':50,61 'accept':133 'access':74,94 'altern':202,211 'applic':9,41,54,68,157 'appreci':199 'bubblewrap':207 'compromis':17,86 'contain':21,43,66,140,149,159,164,169,177 'context':1 'daemon':150 'devic':79,96 'direct':223 'eventu':121 'exampl':118 'explor':32,194 'face':8 'far':138 'fix':123 'found':136 'get':122 'home':15 'host':5,57,154 'influenc':76 'inform':228 'insid':69 'intend':219 'interfer':52,63 'kernel':116 'like':114,125,215 'local':82 'manner':226 'may':110 'might':22 'mode':143 'must':47,58,71,180 'network':83,91,175,179 'note':99 'occasion':112 'one':24 'otherwis':85 'present':208 'public':7 'public-fac':6 'ran':171 'realiz':20 'reason':104,128 'requir':36 'resourc':201 'restrict':182 'risk':124 'rootless':142 'rout':34 'run':40,55,139,147,156 'scarc':235 'secur':18,88 'seem':214 'seen':206 'server':12 'shall':193 'solut':203 'sometim':108 'ssh':98 'still':93,185 'sure':187 'understand':106 'unprivileg':153,161,174 'use':222,230 'user':155,162,165 'via':97 'vulner':113 'want':3,30,38 'way':25 'will':131 'within':42,103,127 'without':16 'word':146 'would':120,198"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1704677667
  +visibility: "visible             "
  +apId: "https://lemmy.ml/post/10216078"
  +editedAt: DateTimeImmutable @1712598393 {#2079
    date: 2024-04-08 19:46:33.0 +02:00
  }
  +createdAt: DateTimeImmutable @1704591267 {#2062
    date: 2024-01-07 02:34:27.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
12 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1626
  +user: Proxies\__CG__\App\Entity\User {#2338 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
  +slug: "How-to-secure-podman-or-docker-containers-for-public-facing-hosting"
  +title: "How to secure (podman or docker) containers for public-facing hosting?"
  +url: null
  +body: """
    Context\n
    -------\n
    \n
    I want to host public-facing applications on a server in my home, without compromising security. I realize containers might be one way to do this, and want to explore that route further.\n
    \n
    Requirements\n
    ------------\n
    \n
    I want to run applications within containers such that they\n
    \n
    - Must not be able to interfere with applications running on host\n
    - Must not be able to interfere with other containers or applications inside them\n
    - Must have no access or influence on other devices in the local network, or otherwise compromise the security of the network, but still accessible by devices via ssh.\n
    \n
    > Note: all of this within reason. I understand that sometimes there may be occasional vulnerabilities, like in kernel for example, that would eventually get fixed. Risks like this within reason I am willing to accept.\n
    \n
    What I found so far\n
    -------------------\n
    \n
    - **Running containers in rootless mode:** in other words, running the container daemon with an unprivileged host user\n
    - **Running applications in container under unprivileged users:** the container user under which the container is ran should be unprivileged\n
    - **Networking:** The container’s networking must be restricted. I am still not sure how to do this and shall explore it more, but would appreciate any resources.\n
    \n
    Alternative solution\n
    --------------------\n
    \n
    I have seen bubblewrap presented as an alternative, but it seems like it is not intended to be used directly in this manner, and information about using it for this is scarce.
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 21
  +favouriteCount: 83
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1719138740 {#2337
    date: 2024-06-23 12:32:20.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2159 …}
  +votes: Doctrine\ORM\PersistentCollection {#2074 …}
  +reports: Doctrine\ORM\PersistentCollection {#2071 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2070 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2048 …}
  +badges: Doctrine\ORM\PersistentCollection {#2056 …}
  +children: [
    1 => App\Entity\EntryComment {#1628
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: null
      +root: null
      +body: """
        You already mentioned the most important things.\n
        \n
        I will add, at the cost of being pedantic:\n
        \n
        - build the image properly, or use good images. This means limit dependencies as much as possible, as minimal images as possible (less updates due to CVEs, less tooling).\n
        - do not mount host volumes, if you really have to, use a dedicated subpath owned by the user of the container. Do not use homedirs etc.\n
        - do not run in host namespaces, like host network etc. Use port mapping to send traffic to the container.\n
        \n
        If you want to go hardcore:\n
        \n
        - analyze your application, and if feasible, build and use a more restrictive seccomp profile compared to the default. This might limit additional syscalls that might be used during an exploitation but that your app doesn’t need.\n
        - run falco on the node. Even with the default set of rules (nothing custom), many exploitation or posts-exploitation steps would be caught, such as “shell spawned” etc.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 6
      +score: 0
      +lastActive: DateTime @1719122506 {#1630
        date: 2024-06-23 08:01:46.0 +02:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@cyclohexane@lemmy.ml"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1599 …}
      +nested: Doctrine\ORM\PersistentCollection {#1625 …}
      +votes: Doctrine\ORM\PersistentCollection {#1617 …}
      +reports: Doctrine\ORM\PersistentCollection {#1725 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1722 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1726 …}
      -id: 288266
      -bodyTs: "'add':10 'addit':117 'alreadi':2 'analyz':96 'app':129 'applic':98 'build':17,102 'caught':156 'compar':110 'contain':65,89 'cost':13 'custom':146 'cves':42 'dedic':57 'default':113,141 'depend':28 'doesn':130 'due':40 'etc':70,80,161 'even':138 'exploit':125,148,152 'falco':134 'feasibl':101 'go':94 'good':23 'hardcor':95 'homedir':69 'host':48,75,78 'imag':19,24,35 'import':6 'less':38,43 'like':77 'limit':27,116 'mani':147 'map':83 'mean':26 'mention':3 'might':115,120 'minim':34 'mount':47 'much':30 'namespac':76 'need':132 'network':79 'node':137 'noth':145 'own':59 'pedant':16 'port':82 'possibl':32,37 'post':151 'posts-exploit':150 'profil':109 'proper':20 'realli':52 'restrict':107 'rule':144 'run':73,133 'seccomp':108 'send':85 'set':142 'shell':159 'spawn':160 'step':153 'subpath':58 'syscal':118 'thing':7 'tool':44 'traffic':86 'updat':39 'use':22,55,68,81,104,122 'user':62 'volum':49 'want':92 'would':154"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6473668"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704620762 {#1629
        date: 2024-01-07 10:46:02.0 +01:00
      }
      +"title": 288266
    }
    0 => App\Entity\EntryComment {#1737
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1734 …}
      +root: App\Entity\EntryComment {#1628}
      +body: "It’s the de-facto standard for runtime container security (sysdig is based on it). The only competitor afaik is aqua security’s tracee, which is way less mature. It is very well supporter, there are tons of rules maintained by the community and it is a CNCF project used by enterprise solutions (I.e., shouldn’t disappear overnight)."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 1
      +score: 0
      +lastActive: DateTime @1704690575 {#1736
        date: 2024-01-08 06:09:35.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@cyclohexane@lemmy.ml"
        "@sudneo@lemmy.world"
        "@krash@lemmy.ml"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1732 …}
      +nested: Doctrine\ORM\PersistentCollection {#1735 …}
      +votes: Doctrine\ORM\PersistentCollection {#1729 …}
      +reports: Doctrine\ORM\PersistentCollection {#1719 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1714 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1720 …}
      -id: 290565
      -bodyTs: "'afaik':20 'aqua':22 'base':14 'cncf':49 'communiti':44 'competitor':19 'contain':10 'de':5 'de-facto':4 'disappear':58 'enterpris':53 'facto':6 'i.e':55 'less':29 'maintain':41 'matur':30 'overnight':59 'project':50 'rule':40 'runtim':9 'secur':11,23 'shouldn':56 'solut':54 'standard':7 'support':35 'sysdig':12 'ton':38 'trace':25 'use':51 'way':28 'well':34"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6491825"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704690575 {#1730
        date: 2024-01-08 06:09:35.0 +01:00
      }
      +"title": 290565
    }
  ]
  -id: 27753
  -titleTs: "'contain':7 'docker':6 'face':11 'host':12 'podman':4 'public':10 'public-fac':9 'secur':3"
  -bodyTs: "'abl':50,61 'accept':133 'access':74,94 'altern':202,211 'applic':9,41,54,68,157 'appreci':199 'bubblewrap':207 'compromis':17,86 'contain':21,43,66,140,149,159,164,169,177 'context':1 'daemon':150 'devic':79,96 'direct':223 'eventu':121 'exampl':118 'explor':32,194 'face':8 'far':138 'fix':123 'found':136 'get':122 'home':15 'host':5,57,154 'influenc':76 'inform':228 'insid':69 'intend':219 'interfer':52,63 'kernel':116 'like':114,125,215 'local':82 'manner':226 'may':110 'might':22 'mode':143 'must':47,58,71,180 'network':83,91,175,179 'note':99 'occasion':112 'one':24 'otherwis':85 'present':208 'public':7 'public-fac':6 'ran':171 'realiz':20 'reason':104,128 'requir':36 'resourc':201 'restrict':182 'risk':124 'rootless':142 'rout':34 'run':40,55,139,147,156 'scarc':235 'secur':18,88 'seem':214 'seen':206 'server':12 'shall':193 'solut':203 'sometim':108 'ssh':98 'still':93,185 'sure':187 'understand':106 'unprivileg':153,161,174 'use':222,230 'user':155,162,165 'via':97 'vulner':113 'want':3,30,38 'way':25 'will':131 'within':42,103,127 'without':16 'word':146 'would':120,198"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1704677667
  +visibility: "visible             "
  +apId: "https://lemmy.ml/post/10216078"
  +editedAt: DateTimeImmutable @1712598393 {#2079
    date: 2024-04-08 19:46:33.0 +02:00
  }
  +createdAt: DateTimeImmutable @1704591267 {#2062
    date: 2024-01-07 02:34:27.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
13 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
14 DENIED moderate 
App\Entity\EntryComment {#1628
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1626
    +user: Proxies\__CG__\App\Entity\User {#2338 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
    +slug: "How-to-secure-podman-or-docker-containers-for-public-facing-hosting"
    +title: "How to secure (podman or docker) containers for public-facing hosting?"
    +url: null
    +body: """
      Context\n
      -------\n
      \n
      I want to host public-facing applications on a server in my home, without compromising security. I realize containers might be one way to do this, and want to explore that route further.\n
      \n
      Requirements\n
      ------------\n
      \n
      I want to run applications within containers such that they\n
      \n
      - Must not be able to interfere with applications running on host\n
      - Must not be able to interfere with other containers or applications inside them\n
      - Must have no access or influence on other devices in the local network, or otherwise compromise the security of the network, but still accessible by devices via ssh.\n
      \n
      > Note: all of this within reason. I understand that sometimes there may be occasional vulnerabilities, like in kernel for example, that would eventually get fixed. Risks like this within reason I am willing to accept.\n
      \n
      What I found so far\n
      -------------------\n
      \n
      - **Running containers in rootless mode:** in other words, running the container daemon with an unprivileged host user\n
      - **Running applications in container under unprivileged users:** the container user under which the container is ran should be unprivileged\n
      - **Networking:** The container’s networking must be restricted. I am still not sure how to do this and shall explore it more, but would appreciate any resources.\n
      \n
      Alternative solution\n
      --------------------\n
      \n
      I have seen bubblewrap presented as an alternative, but it seems like it is not intended to be used directly in this manner, and information about using it for this is scarce.
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 21
    +favouriteCount: 83
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719138740 {#2337
      date: 2024-06-23 12:32:20.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2159 …}
    +votes: Doctrine\ORM\PersistentCollection {#2074 …}
    +reports: Doctrine\ORM\PersistentCollection {#2071 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2070 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2048 …}
    +badges: Doctrine\ORM\PersistentCollection {#2056 …}
    +children: [
      1 => App\Entity\EntryComment {#1628}
      0 => App\Entity\EntryComment {#1737
        +user: App\Entity\User {#261 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1734 …}
        +root: App\Entity\EntryComment {#1628}
        +body: "It’s the de-facto standard for runtime container security (sysdig is based on it). The only competitor afaik is aqua security’s tracee, which is way less mature. It is very well supporter, there are tons of rules maintained by the community and it is a CNCF project used by enterprise solutions (I.e., shouldn’t disappear overnight)."
        +lang: "en"
        +isAdult: false
        +favouriteCount: 1
        +score: 0
        +lastActive: DateTime @1704690575 {#1736
          date: 2024-01-08 06:09:35.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@cyclohexane@lemmy.ml"
          "@sudneo@lemmy.world"
          "@krash@lemmy.ml"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1732 …}
        +nested: Doctrine\ORM\PersistentCollection {#1735 …}
        +votes: Doctrine\ORM\PersistentCollection {#1729 …}
        +reports: Doctrine\ORM\PersistentCollection {#1719 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1714 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1720 …}
        -id: 290565
        -bodyTs: "'afaik':20 'aqua':22 'base':14 'cncf':49 'communiti':44 'competitor':19 'contain':10 'de':5 'de-facto':4 'disappear':58 'enterpris':53 'facto':6 'i.e':55 'less':29 'maintain':41 'matur':30 'overnight':59 'project':50 'rule':40 'runtim':9 'secur':11,23 'shouldn':56 'solut':54 'standard':7 'support':35 'sysdig':12 'ton':38 'trace':25 'use':51 'way':28 'well':34"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6491825"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704690575 {#1730
          date: 2024-01-08 06:09:35.0 +01:00
        }
        +"title": 290565
      }
    ]
    -id: 27753
    -titleTs: "'contain':7 'docker':6 'face':11 'host':12 'podman':4 'public':10 'public-fac':9 'secur':3"
    -bodyTs: "'abl':50,61 'accept':133 'access':74,94 'altern':202,211 'applic':9,41,54,68,157 'appreci':199 'bubblewrap':207 'compromis':17,86 'contain':21,43,66,140,149,159,164,169,177 'context':1 'daemon':150 'devic':79,96 'direct':223 'eventu':121 'exampl':118 'explor':32,194 'face':8 'far':138 'fix':123 'found':136 'get':122 'home':15 'host':5,57,154 'influenc':76 'inform':228 'insid':69 'intend':219 'interfer':52,63 'kernel':116 'like':114,125,215 'local':82 'manner':226 'may':110 'might':22 'mode':143 'must':47,58,71,180 'network':83,91,175,179 'note':99 'occasion':112 'one':24 'otherwis':85 'present':208 'public':7 'public-fac':6 'ran':171 'realiz':20 'reason':104,128 'requir':36 'resourc':201 'restrict':182 'risk':124 'rootless':142 'rout':34 'run':40,55,139,147,156 'scarc':235 'secur':18,88 'seem':214 'seen':206 'server':12 'shall':193 'solut':203 'sometim':108 'ssh':98 'still':93,185 'sure':187 'understand':106 'unprivileg':153,161,174 'use':222,230 'user':155,162,165 'via':97 'vulner':113 'want':3,30,38 'way':25 'will':131 'within':42,103,127 'without':16 'word':146 'would':120,198"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704677667
    +visibility: "visible             "
    +apId: "https://lemmy.ml/post/10216078"
    +editedAt: DateTimeImmutable @1712598393 {#2079
      date: 2024-04-08 19:46:33.0 +02:00
    }
    +createdAt: DateTimeImmutable @1704591267 {#2062
      date: 2024-01-07 02:34:27.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: null
  +root: null
  +body: """
    You already mentioned the most important things.\n
    \n
    I will add, at the cost of being pedantic:\n
    \n
    - build the image properly, or use good images. This means limit dependencies as much as possible, as minimal images as possible (less updates due to CVEs, less tooling).\n
    - do not mount host volumes, if you really have to, use a dedicated subpath owned by the user of the container. Do not use homedirs etc.\n
    - do not run in host namespaces, like host network etc. Use port mapping to send traffic to the container.\n
    \n
    If you want to go hardcore:\n
    \n
    - analyze your application, and if feasible, build and use a more restrictive seccomp profile compared to the default. This might limit additional syscalls that might be used during an exploitation but that your app doesn’t need.\n
    - run falco on the node. Even with the default set of rules (nothing custom), many exploitation or posts-exploitation steps would be caught, such as “shell spawned” etc.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 6
  +score: 0
  +lastActive: DateTime @1719122506 {#1630
    date: 2024-06-23 08:01:46.0 +02:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@cyclohexane@lemmy.ml"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1599 …}
  +nested: Doctrine\ORM\PersistentCollection {#1625 …}
  +votes: Doctrine\ORM\PersistentCollection {#1617 …}
  +reports: Doctrine\ORM\PersistentCollection {#1725 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1722 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1726 …}
  -id: 288266
  -bodyTs: "'add':10 'addit':117 'alreadi':2 'analyz':96 'app':129 'applic':98 'build':17,102 'caught':156 'compar':110 'contain':65,89 'cost':13 'custom':146 'cves':42 'dedic':57 'default':113,141 'depend':28 'doesn':130 'due':40 'etc':70,80,161 'even':138 'exploit':125,148,152 'falco':134 'feasibl':101 'go':94 'good':23 'hardcor':95 'homedir':69 'host':48,75,78 'imag':19,24,35 'import':6 'less':38,43 'like':77 'limit':27,116 'mani':147 'map':83 'mean':26 'mention':3 'might':115,120 'minim':34 'mount':47 'much':30 'namespac':76 'need':132 'network':79 'node':137 'noth':145 'own':59 'pedant':16 'port':82 'possibl':32,37 'post':151 'posts-exploit':150 'profil':109 'proper':20 'realli':52 'restrict':107 'rule':144 'run':73,133 'seccomp':108 'send':85 'set':142 'shell':159 'spawn':160 'step':153 'subpath':58 'syscal':118 'thing':7 'tool':44 'traffic':86 'updat':39 'use':22,55,68,81,104,122 'user':62 'volum':49 'want':92 'would':154"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6473668"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704620762 {#1629
    date: 2024-01-07 10:46:02.0 +01:00
  }
  +"title": 288266
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
15 DENIED edit 
App\Entity\EntryComment {#1628
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1626
    +user: Proxies\__CG__\App\Entity\User {#2338 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
    +slug: "How-to-secure-podman-or-docker-containers-for-public-facing-hosting"
    +title: "How to secure (podman or docker) containers for public-facing hosting?"
    +url: null
    +body: """
      Context\n
      -------\n
      \n
      I want to host public-facing applications on a server in my home, without compromising security. I realize containers might be one way to do this, and want to explore that route further.\n
      \n
      Requirements\n
      ------------\n
      \n
      I want to run applications within containers such that they\n
      \n
      - Must not be able to interfere with applications running on host\n
      - Must not be able to interfere with other containers or applications inside them\n
      - Must have no access or influence on other devices in the local network, or otherwise compromise the security of the network, but still accessible by devices via ssh.\n
      \n
      > Note: all of this within reason. I understand that sometimes there may be occasional vulnerabilities, like in kernel for example, that would eventually get fixed. Risks like this within reason I am willing to accept.\n
      \n
      What I found so far\n
      -------------------\n
      \n
      - **Running containers in rootless mode:** in other words, running the container daemon with an unprivileged host user\n
      - **Running applications in container under unprivileged users:** the container user under which the container is ran should be unprivileged\n
      - **Networking:** The container’s networking must be restricted. I am still not sure how to do this and shall explore it more, but would appreciate any resources.\n
      \n
      Alternative solution\n
      --------------------\n
      \n
      I have seen bubblewrap presented as an alternative, but it seems like it is not intended to be used directly in this manner, and information about using it for this is scarce.
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 21
    +favouriteCount: 83
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719138740 {#2337
      date: 2024-06-23 12:32:20.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2159 …}
    +votes: Doctrine\ORM\PersistentCollection {#2074 …}
    +reports: Doctrine\ORM\PersistentCollection {#2071 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2070 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2048 …}
    +badges: Doctrine\ORM\PersistentCollection {#2056 …}
    +children: [
      1 => App\Entity\EntryComment {#1628}
      0 => App\Entity\EntryComment {#1737
        +user: App\Entity\User {#261 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1734 …}
        +root: App\Entity\EntryComment {#1628}
        +body: "It’s the de-facto standard for runtime container security (sysdig is based on it). The only competitor afaik is aqua security’s tracee, which is way less mature. It is very well supporter, there are tons of rules maintained by the community and it is a CNCF project used by enterprise solutions (I.e., shouldn’t disappear overnight)."
        +lang: "en"
        +isAdult: false
        +favouriteCount: 1
        +score: 0
        +lastActive: DateTime @1704690575 {#1736
          date: 2024-01-08 06:09:35.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@cyclohexane@lemmy.ml"
          "@sudneo@lemmy.world"
          "@krash@lemmy.ml"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1732 …}
        +nested: Doctrine\ORM\PersistentCollection {#1735 …}
        +votes: Doctrine\ORM\PersistentCollection {#1729 …}
        +reports: Doctrine\ORM\PersistentCollection {#1719 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1714 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1720 …}
        -id: 290565
        -bodyTs: "'afaik':20 'aqua':22 'base':14 'cncf':49 'communiti':44 'competitor':19 'contain':10 'de':5 'de-facto':4 'disappear':58 'enterpris':53 'facto':6 'i.e':55 'less':29 'maintain':41 'matur':30 'overnight':59 'project':50 'rule':40 'runtim':9 'secur':11,23 'shouldn':56 'solut':54 'standard':7 'support':35 'sysdig':12 'ton':38 'trace':25 'use':51 'way':28 'well':34"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6491825"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704690575 {#1730
          date: 2024-01-08 06:09:35.0 +01:00
        }
        +"title": 290565
      }
    ]
    -id: 27753
    -titleTs: "'contain':7 'docker':6 'face':11 'host':12 'podman':4 'public':10 'public-fac':9 'secur':3"
    -bodyTs: "'abl':50,61 'accept':133 'access':74,94 'altern':202,211 'applic':9,41,54,68,157 'appreci':199 'bubblewrap':207 'compromis':17,86 'contain':21,43,66,140,149,159,164,169,177 'context':1 'daemon':150 'devic':79,96 'direct':223 'eventu':121 'exampl':118 'explor':32,194 'face':8 'far':138 'fix':123 'found':136 'get':122 'home':15 'host':5,57,154 'influenc':76 'inform':228 'insid':69 'intend':219 'interfer':52,63 'kernel':116 'like':114,125,215 'local':82 'manner':226 'may':110 'might':22 'mode':143 'must':47,58,71,180 'network':83,91,175,179 'note':99 'occasion':112 'one':24 'otherwis':85 'present':208 'public':7 'public-fac':6 'ran':171 'realiz':20 'reason':104,128 'requir':36 'resourc':201 'restrict':182 'risk':124 'rootless':142 'rout':34 'run':40,55,139,147,156 'scarc':235 'secur':18,88 'seem':214 'seen':206 'server':12 'shall':193 'solut':203 'sometim':108 'ssh':98 'still':93,185 'sure':187 'understand':106 'unprivileg':153,161,174 'use':222,230 'user':155,162,165 'via':97 'vulner':113 'want':3,30,38 'way':25 'will':131 'within':42,103,127 'without':16 'word':146 'would':120,198"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704677667
    +visibility: "visible             "
    +apId: "https://lemmy.ml/post/10216078"
    +editedAt: DateTimeImmutable @1712598393 {#2079
      date: 2024-04-08 19:46:33.0 +02:00
    }
    +createdAt: DateTimeImmutable @1704591267 {#2062
      date: 2024-01-07 02:34:27.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: null
  +root: null
  +body: """
    You already mentioned the most important things.\n
    \n
    I will add, at the cost of being pedantic:\n
    \n
    - build the image properly, or use good images. This means limit dependencies as much as possible, as minimal images as possible (less updates due to CVEs, less tooling).\n
    - do not mount host volumes, if you really have to, use a dedicated subpath owned by the user of the container. Do not use homedirs etc.\n
    - do not run in host namespaces, like host network etc. Use port mapping to send traffic to the container.\n
    \n
    If you want to go hardcore:\n
    \n
    - analyze your application, and if feasible, build and use a more restrictive seccomp profile compared to the default. This might limit additional syscalls that might be used during an exploitation but that your app doesn’t need.\n
    - run falco on the node. Even with the default set of rules (nothing custom), many exploitation or posts-exploitation steps would be caught, such as “shell spawned” etc.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 6
  +score: 0
  +lastActive: DateTime @1719122506 {#1630
    date: 2024-06-23 08:01:46.0 +02:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@cyclohexane@lemmy.ml"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1599 …}
  +nested: Doctrine\ORM\PersistentCollection {#1625 …}
  +votes: Doctrine\ORM\PersistentCollection {#1617 …}
  +reports: Doctrine\ORM\PersistentCollection {#1725 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1722 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1726 …}
  -id: 288266
  -bodyTs: "'add':10 'addit':117 'alreadi':2 'analyz':96 'app':129 'applic':98 'build':17,102 'caught':156 'compar':110 'contain':65,89 'cost':13 'custom':146 'cves':42 'dedic':57 'default':113,141 'depend':28 'doesn':130 'due':40 'etc':70,80,161 'even':138 'exploit':125,148,152 'falco':134 'feasibl':101 'go':94 'good':23 'hardcor':95 'homedir':69 'host':48,75,78 'imag':19,24,35 'import':6 'less':38,43 'like':77 'limit':27,116 'mani':147 'map':83 'mean':26 'mention':3 'might':115,120 'minim':34 'mount':47 'much':30 'namespac':76 'need':132 'network':79 'node':137 'noth':145 'own':59 'pedant':16 'port':82 'possibl':32,37 'post':151 'posts-exploit':150 'profil':109 'proper':20 'realli':52 'restrict':107 'rule':144 'run':73,133 'seccomp':108 'send':85 'set':142 'shell':159 'spawn':160 'step':153 'subpath':58 'syscal':118 'thing':7 'tool':44 'traffic':86 'updat':39 'use':22,55,68,81,104,122 'user':62 'volum':49 'want':92 'would':154"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6473668"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704620762 {#1629
    date: 2024-01-07 10:46:02.0 +01:00
  }
  +"title": 288266
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
16 DENIED moderate 
App\Entity\EntryComment {#1628
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1626
    +user: Proxies\__CG__\App\Entity\User {#2338 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
    +slug: "How-to-secure-podman-or-docker-containers-for-public-facing-hosting"
    +title: "How to secure (podman or docker) containers for public-facing hosting?"
    +url: null
    +body: """
      Context\n
      -------\n
      \n
      I want to host public-facing applications on a server in my home, without compromising security. I realize containers might be one way to do this, and want to explore that route further.\n
      \n
      Requirements\n
      ------------\n
      \n
      I want to run applications within containers such that they\n
      \n
      - Must not be able to interfere with applications running on host\n
      - Must not be able to interfere with other containers or applications inside them\n
      - Must have no access or influence on other devices in the local network, or otherwise compromise the security of the network, but still accessible by devices via ssh.\n
      \n
      > Note: all of this within reason. I understand that sometimes there may be occasional vulnerabilities, like in kernel for example, that would eventually get fixed. Risks like this within reason I am willing to accept.\n
      \n
      What I found so far\n
      -------------------\n
      \n
      - **Running containers in rootless mode:** in other words, running the container daemon with an unprivileged host user\n
      - **Running applications in container under unprivileged users:** the container user under which the container is ran should be unprivileged\n
      - **Networking:** The container’s networking must be restricted. I am still not sure how to do this and shall explore it more, but would appreciate any resources.\n
      \n
      Alternative solution\n
      --------------------\n
      \n
      I have seen bubblewrap presented as an alternative, but it seems like it is not intended to be used directly in this manner, and information about using it for this is scarce.
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 21
    +favouriteCount: 83
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719138740 {#2337
      date: 2024-06-23 12:32:20.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2159 …}
    +votes: Doctrine\ORM\PersistentCollection {#2074 …}
    +reports: Doctrine\ORM\PersistentCollection {#2071 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2070 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2048 …}
    +badges: Doctrine\ORM\PersistentCollection {#2056 …}
    +children: [
      1 => App\Entity\EntryComment {#1628}
      0 => App\Entity\EntryComment {#1737
        +user: App\Entity\User {#261 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1734 …}
        +root: App\Entity\EntryComment {#1628}
        +body: "It’s the de-facto standard for runtime container security (sysdig is based on it). The only competitor afaik is aqua security’s tracee, which is way less mature. It is very well supporter, there are tons of rules maintained by the community and it is a CNCF project used by enterprise solutions (I.e., shouldn’t disappear overnight)."
        +lang: "en"
        +isAdult: false
        +favouriteCount: 1
        +score: 0
        +lastActive: DateTime @1704690575 {#1736
          date: 2024-01-08 06:09:35.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@cyclohexane@lemmy.ml"
          "@sudneo@lemmy.world"
          "@krash@lemmy.ml"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1732 …}
        +nested: Doctrine\ORM\PersistentCollection {#1735 …}
        +votes: Doctrine\ORM\PersistentCollection {#1729 …}
        +reports: Doctrine\ORM\PersistentCollection {#1719 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1714 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1720 …}
        -id: 290565
        -bodyTs: "'afaik':20 'aqua':22 'base':14 'cncf':49 'communiti':44 'competitor':19 'contain':10 'de':5 'de-facto':4 'disappear':58 'enterpris':53 'facto':6 'i.e':55 'less':29 'maintain':41 'matur':30 'overnight':59 'project':50 'rule':40 'runtim':9 'secur':11,23 'shouldn':56 'solut':54 'standard':7 'support':35 'sysdig':12 'ton':38 'trace':25 'use':51 'way':28 'well':34"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6491825"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704690575 {#1730
          date: 2024-01-08 06:09:35.0 +01:00
        }
        +"title": 290565
      }
    ]
    -id: 27753
    -titleTs: "'contain':7 'docker':6 'face':11 'host':12 'podman':4 'public':10 'public-fac':9 'secur':3"
    -bodyTs: "'abl':50,61 'accept':133 'access':74,94 'altern':202,211 'applic':9,41,54,68,157 'appreci':199 'bubblewrap':207 'compromis':17,86 'contain':21,43,66,140,149,159,164,169,177 'context':1 'daemon':150 'devic':79,96 'direct':223 'eventu':121 'exampl':118 'explor':32,194 'face':8 'far':138 'fix':123 'found':136 'get':122 'home':15 'host':5,57,154 'influenc':76 'inform':228 'insid':69 'intend':219 'interfer':52,63 'kernel':116 'like':114,125,215 'local':82 'manner':226 'may':110 'might':22 'mode':143 'must':47,58,71,180 'network':83,91,175,179 'note':99 'occasion':112 'one':24 'otherwis':85 'present':208 'public':7 'public-fac':6 'ran':171 'realiz':20 'reason':104,128 'requir':36 'resourc':201 'restrict':182 'risk':124 'rootless':142 'rout':34 'run':40,55,139,147,156 'scarc':235 'secur':18,88 'seem':214 'seen':206 'server':12 'shall':193 'solut':203 'sometim':108 'ssh':98 'still':93,185 'sure':187 'understand':106 'unprivileg':153,161,174 'use':222,230 'user':155,162,165 'via':97 'vulner':113 'want':3,30,38 'way':25 'will':131 'within':42,103,127 'without':16 'word':146 'would':120,198"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704677667
    +visibility: "visible             "
    +apId: "https://lemmy.ml/post/10216078"
    +editedAt: DateTimeImmutable @1712598393 {#2079
      date: 2024-04-08 19:46:33.0 +02:00
    }
    +createdAt: DateTimeImmutable @1704591267 {#2062
      date: 2024-01-07 02:34:27.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: null
  +root: null
  +body: """
    You already mentioned the most important things.\n
    \n
    I will add, at the cost of being pedantic:\n
    \n
    - build the image properly, or use good images. This means limit dependencies as much as possible, as minimal images as possible (less updates due to CVEs, less tooling).\n
    - do not mount host volumes, if you really have to, use a dedicated subpath owned by the user of the container. Do not use homedirs etc.\n
    - do not run in host namespaces, like host network etc. Use port mapping to send traffic to the container.\n
    \n
    If you want to go hardcore:\n
    \n
    - analyze your application, and if feasible, build and use a more restrictive seccomp profile compared to the default. This might limit additional syscalls that might be used during an exploitation but that your app doesn’t need.\n
    - run falco on the node. Even with the default set of rules (nothing custom), many exploitation or posts-exploitation steps would be caught, such as “shell spawned” etc.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 6
  +score: 0
  +lastActive: DateTime @1719122506 {#1630
    date: 2024-06-23 08:01:46.0 +02:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@cyclohexane@lemmy.ml"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1599 …}
  +nested: Doctrine\ORM\PersistentCollection {#1625 …}
  +votes: Doctrine\ORM\PersistentCollection {#1617 …}
  +reports: Doctrine\ORM\PersistentCollection {#1725 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1722 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1726 …}
  -id: 288266
  -bodyTs: "'add':10 'addit':117 'alreadi':2 'analyz':96 'app':129 'applic':98 'build':17,102 'caught':156 'compar':110 'contain':65,89 'cost':13 'custom':146 'cves':42 'dedic':57 'default':113,141 'depend':28 'doesn':130 'due':40 'etc':70,80,161 'even':138 'exploit':125,148,152 'falco':134 'feasibl':101 'go':94 'good':23 'hardcor':95 'homedir':69 'host':48,75,78 'imag':19,24,35 'import':6 'less':38,43 'like':77 'limit':27,116 'mani':147 'map':83 'mean':26 'mention':3 'might':115,120 'minim':34 'mount':47 'much':30 'namespac':76 'need':132 'network':79 'node':137 'noth':145 'own':59 'pedant':16 'port':82 'possibl':32,37 'post':151 'posts-exploit':150 'profil':109 'proper':20 'realli':52 'restrict':107 'rule':144 'run':73,133 'seccomp':108 'send':85 'set':142 'shell':159 'spawn':160 'step':153 'subpath':58 'syscal':118 'thing':7 'tool':44 'traffic':86 'updat':39 'use':22,55,68,81,104,122 'user':62 'volum':49 'want':92 'would':154"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6473668"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704620762 {#1629
    date: 2024-01-07 10:46:02.0 +01:00
  }
  +"title": 288266
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
17 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
18 DENIED moderate 
App\Entity\EntryComment {#1737
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1626
    +user: Proxies\__CG__\App\Entity\User {#2338 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
    +slug: "How-to-secure-podman-or-docker-containers-for-public-facing-hosting"
    +title: "How to secure (podman or docker) containers for public-facing hosting?"
    +url: null
    +body: """
      Context\n
      -------\n
      \n
      I want to host public-facing applications on a server in my home, without compromising security. I realize containers might be one way to do this, and want to explore that route further.\n
      \n
      Requirements\n
      ------------\n
      \n
      I want to run applications within containers such that they\n
      \n
      - Must not be able to interfere with applications running on host\n
      - Must not be able to interfere with other containers or applications inside them\n
      - Must have no access or influence on other devices in the local network, or otherwise compromise the security of the network, but still accessible by devices via ssh.\n
      \n
      > Note: all of this within reason. I understand that sometimes there may be occasional vulnerabilities, like in kernel for example, that would eventually get fixed. Risks like this within reason I am willing to accept.\n
      \n
      What I found so far\n
      -------------------\n
      \n
      - **Running containers in rootless mode:** in other words, running the container daemon with an unprivileged host user\n
      - **Running applications in container under unprivileged users:** the container user under which the container is ran should be unprivileged\n
      - **Networking:** The container’s networking must be restricted. I am still not sure how to do this and shall explore it more, but would appreciate any resources.\n
      \n
      Alternative solution\n
      --------------------\n
      \n
      I have seen bubblewrap presented as an alternative, but it seems like it is not intended to be used directly in this manner, and information about using it for this is scarce.
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 21
    +favouriteCount: 83
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719138740 {#2337
      date: 2024-06-23 12:32:20.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2159 …}
    +votes: Doctrine\ORM\PersistentCollection {#2074 …}
    +reports: Doctrine\ORM\PersistentCollection {#2071 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2070 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2048 …}
    +badges: Doctrine\ORM\PersistentCollection {#2056 …}
    +children: [
      1 => App\Entity\EntryComment {#1628
        +user: App\Entity\User {#261 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
        +image: null
        +parent: null
        +root: null
        +body: """
          You already mentioned the most important things.\n
          \n
          I will add, at the cost of being pedantic:\n
          \n
          - build the image properly, or use good images. This means limit dependencies as much as possible, as minimal images as possible (less updates due to CVEs, less tooling).\n
          - do not mount host volumes, if you really have to, use a dedicated subpath owned by the user of the container. Do not use homedirs etc.\n
          - do not run in host namespaces, like host network etc. Use port mapping to send traffic to the container.\n
          \n
          If you want to go hardcore:\n
          \n
          - analyze your application, and if feasible, build and use a more restrictive seccomp profile compared to the default. This might limit additional syscalls that might be used during an exploitation but that your app doesn’t need.\n
          - run falco on the node. Even with the default set of rules (nothing custom), many exploitation or posts-exploitation steps would be caught, such as “shell spawned” etc.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 6
        +score: 0
        +lastActive: DateTime @1719122506 {#1630
          date: 2024-06-23 08:01:46.0 +02:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@cyclohexane@lemmy.ml"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1599 …}
        +nested: Doctrine\ORM\PersistentCollection {#1625 …}
        +votes: Doctrine\ORM\PersistentCollection {#1617 …}
        +reports: Doctrine\ORM\PersistentCollection {#1725 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1722 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1726 …}
        -id: 288266
        -bodyTs: "'add':10 'addit':117 'alreadi':2 'analyz':96 'app':129 'applic':98 'build':17,102 'caught':156 'compar':110 'contain':65,89 'cost':13 'custom':146 'cves':42 'dedic':57 'default':113,141 'depend':28 'doesn':130 'due':40 'etc':70,80,161 'even':138 'exploit':125,148,152 'falco':134 'feasibl':101 'go':94 'good':23 'hardcor':95 'homedir':69 'host':48,75,78 'imag':19,24,35 'import':6 'less':38,43 'like':77 'limit':27,116 'mani':147 'map':83 'mean':26 'mention':3 'might':115,120 'minim':34 'mount':47 'much':30 'namespac':76 'need':132 'network':79 'node':137 'noth':145 'own':59 'pedant':16 'port':82 'possibl':32,37 'post':151 'posts-exploit':150 'profil':109 'proper':20 'realli':52 'restrict':107 'rule':144 'run':73,133 'seccomp':108 'send':85 'set':142 'shell':159 'spawn':160 'step':153 'subpath':58 'syscal':118 'thing':7 'tool':44 'traffic':86 'updat':39 'use':22,55,68,81,104,122 'user':62 'volum':49 'want':92 'would':154"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6473668"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704620762 {#1629
          date: 2024-01-07 10:46:02.0 +01:00
        }
        +"title": 288266
      }
      0 => App\Entity\EntryComment {#1737}
    ]
    -id: 27753
    -titleTs: "'contain':7 'docker':6 'face':11 'host':12 'podman':4 'public':10 'public-fac':9 'secur':3"
    -bodyTs: "'abl':50,61 'accept':133 'access':74,94 'altern':202,211 'applic':9,41,54,68,157 'appreci':199 'bubblewrap':207 'compromis':17,86 'contain':21,43,66,140,149,159,164,169,177 'context':1 'daemon':150 'devic':79,96 'direct':223 'eventu':121 'exampl':118 'explor':32,194 'face':8 'far':138 'fix':123 'found':136 'get':122 'home':15 'host':5,57,154 'influenc':76 'inform':228 'insid':69 'intend':219 'interfer':52,63 'kernel':116 'like':114,125,215 'local':82 'manner':226 'may':110 'might':22 'mode':143 'must':47,58,71,180 'network':83,91,175,179 'note':99 'occasion':112 'one':24 'otherwis':85 'present':208 'public':7 'public-fac':6 'ran':171 'realiz':20 'reason':104,128 'requir':36 'resourc':201 'restrict':182 'risk':124 'rootless':142 'rout':34 'run':40,55,139,147,156 'scarc':235 'secur':18,88 'seem':214 'seen':206 'server':12 'shall':193 'solut':203 'sometim':108 'ssh':98 'still':93,185 'sure':187 'understand':106 'unprivileg':153,161,174 'use':222,230 'user':155,162,165 'via':97 'vulner':113 'want':3,30,38 'way':25 'will':131 'within':42,103,127 'without':16 'word':146 'would':120,198"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704677667
    +visibility: "visible             "
    +apId: "https://lemmy.ml/post/10216078"
    +editedAt: DateTimeImmutable @1712598393 {#2079
      date: 2024-04-08 19:46:33.0 +02:00
    }
    +createdAt: DateTimeImmutable @1704591267 {#2062
      date: 2024-01-07 02:34:27.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1734 …}
  +root: App\Entity\EntryComment {#1628}
  +body: "It’s the de-facto standard for runtime container security (sysdig is based on it). The only competitor afaik is aqua security’s tracee, which is way less mature. It is very well supporter, there are tons of rules maintained by the community and it is a CNCF project used by enterprise solutions (I.e., shouldn’t disappear overnight)."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 1
  +score: 0
  +lastActive: DateTime @1704690575 {#1736
    date: 2024-01-08 06:09:35.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@cyclohexane@lemmy.ml"
    "@sudneo@lemmy.world"
    "@krash@lemmy.ml"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1732 …}
  +nested: Doctrine\ORM\PersistentCollection {#1735 …}
  +votes: Doctrine\ORM\PersistentCollection {#1729 …}
  +reports: Doctrine\ORM\PersistentCollection {#1719 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1714 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1720 …}
  -id: 290565
  -bodyTs: "'afaik':20 'aqua':22 'base':14 'cncf':49 'communiti':44 'competitor':19 'contain':10 'de':5 'de-facto':4 'disappear':58 'enterpris':53 'facto':6 'i.e':55 'less':29 'maintain':41 'matur':30 'overnight':59 'project':50 'rule':40 'runtim':9 'secur':11,23 'shouldn':56 'solut':54 'standard':7 'support':35 'sysdig':12 'ton':38 'trace':25 'use':51 'way':28 'well':34"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6491825"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704690575 {#1730
    date: 2024-01-08 06:09:35.0 +01:00
  }
  +"title": 290565
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
19 DENIED edit 
App\Entity\EntryComment {#1737
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1626
    +user: Proxies\__CG__\App\Entity\User {#2338 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
    +slug: "How-to-secure-podman-or-docker-containers-for-public-facing-hosting"
    +title: "How to secure (podman or docker) containers for public-facing hosting?"
    +url: null
    +body: """
      Context\n
      -------\n
      \n
      I want to host public-facing applications on a server in my home, without compromising security. I realize containers might be one way to do this, and want to explore that route further.\n
      \n
      Requirements\n
      ------------\n
      \n
      I want to run applications within containers such that they\n
      \n
      - Must not be able to interfere with applications running on host\n
      - Must not be able to interfere with other containers or applications inside them\n
      - Must have no access or influence on other devices in the local network, or otherwise compromise the security of the network, but still accessible by devices via ssh.\n
      \n
      > Note: all of this within reason. I understand that sometimes there may be occasional vulnerabilities, like in kernel for example, that would eventually get fixed. Risks like this within reason I am willing to accept.\n
      \n
      What I found so far\n
      -------------------\n
      \n
      - **Running containers in rootless mode:** in other words, running the container daemon with an unprivileged host user\n
      - **Running applications in container under unprivileged users:** the container user under which the container is ran should be unprivileged\n
      - **Networking:** The container’s networking must be restricted. I am still not sure how to do this and shall explore it more, but would appreciate any resources.\n
      \n
      Alternative solution\n
      --------------------\n
      \n
      I have seen bubblewrap presented as an alternative, but it seems like it is not intended to be used directly in this manner, and information about using it for this is scarce.
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 21
    +favouriteCount: 83
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719138740 {#2337
      date: 2024-06-23 12:32:20.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2159 …}
    +votes: Doctrine\ORM\PersistentCollection {#2074 …}
    +reports: Doctrine\ORM\PersistentCollection {#2071 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2070 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2048 …}
    +badges: Doctrine\ORM\PersistentCollection {#2056 …}
    +children: [
      1 => App\Entity\EntryComment {#1628
        +user: App\Entity\User {#261 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
        +image: null
        +parent: null
        +root: null
        +body: """
          You already mentioned the most important things.\n
          \n
          I will add, at the cost of being pedantic:\n
          \n
          - build the image properly, or use good images. This means limit dependencies as much as possible, as minimal images as possible (less updates due to CVEs, less tooling).\n
          - do not mount host volumes, if you really have to, use a dedicated subpath owned by the user of the container. Do not use homedirs etc.\n
          - do not run in host namespaces, like host network etc. Use port mapping to send traffic to the container.\n
          \n
          If you want to go hardcore:\n
          \n
          - analyze your application, and if feasible, build and use a more restrictive seccomp profile compared to the default. This might limit additional syscalls that might be used during an exploitation but that your app doesn’t need.\n
          - run falco on the node. Even with the default set of rules (nothing custom), many exploitation or posts-exploitation steps would be caught, such as “shell spawned” etc.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 6
        +score: 0
        +lastActive: DateTime @1719122506 {#1630
          date: 2024-06-23 08:01:46.0 +02:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@cyclohexane@lemmy.ml"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1599 …}
        +nested: Doctrine\ORM\PersistentCollection {#1625 …}
        +votes: Doctrine\ORM\PersistentCollection {#1617 …}
        +reports: Doctrine\ORM\PersistentCollection {#1725 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1722 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1726 …}
        -id: 288266
        -bodyTs: "'add':10 'addit':117 'alreadi':2 'analyz':96 'app':129 'applic':98 'build':17,102 'caught':156 'compar':110 'contain':65,89 'cost':13 'custom':146 'cves':42 'dedic':57 'default':113,141 'depend':28 'doesn':130 'due':40 'etc':70,80,161 'even':138 'exploit':125,148,152 'falco':134 'feasibl':101 'go':94 'good':23 'hardcor':95 'homedir':69 'host':48,75,78 'imag':19,24,35 'import':6 'less':38,43 'like':77 'limit':27,116 'mani':147 'map':83 'mean':26 'mention':3 'might':115,120 'minim':34 'mount':47 'much':30 'namespac':76 'need':132 'network':79 'node':137 'noth':145 'own':59 'pedant':16 'port':82 'possibl':32,37 'post':151 'posts-exploit':150 'profil':109 'proper':20 'realli':52 'restrict':107 'rule':144 'run':73,133 'seccomp':108 'send':85 'set':142 'shell':159 'spawn':160 'step':153 'subpath':58 'syscal':118 'thing':7 'tool':44 'traffic':86 'updat':39 'use':22,55,68,81,104,122 'user':62 'volum':49 'want':92 'would':154"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6473668"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704620762 {#1629
          date: 2024-01-07 10:46:02.0 +01:00
        }
        +"title": 288266
      }
      0 => App\Entity\EntryComment {#1737}
    ]
    -id: 27753
    -titleTs: "'contain':7 'docker':6 'face':11 'host':12 'podman':4 'public':10 'public-fac':9 'secur':3"
    -bodyTs: "'abl':50,61 'accept':133 'access':74,94 'altern':202,211 'applic':9,41,54,68,157 'appreci':199 'bubblewrap':207 'compromis':17,86 'contain':21,43,66,140,149,159,164,169,177 'context':1 'daemon':150 'devic':79,96 'direct':223 'eventu':121 'exampl':118 'explor':32,194 'face':8 'far':138 'fix':123 'found':136 'get':122 'home':15 'host':5,57,154 'influenc':76 'inform':228 'insid':69 'intend':219 'interfer':52,63 'kernel':116 'like':114,125,215 'local':82 'manner':226 'may':110 'might':22 'mode':143 'must':47,58,71,180 'network':83,91,175,179 'note':99 'occasion':112 'one':24 'otherwis':85 'present':208 'public':7 'public-fac':6 'ran':171 'realiz':20 'reason':104,128 'requir':36 'resourc':201 'restrict':182 'risk':124 'rootless':142 'rout':34 'run':40,55,139,147,156 'scarc':235 'secur':18,88 'seem':214 'seen':206 'server':12 'shall':193 'solut':203 'sometim':108 'ssh':98 'still':93,185 'sure':187 'understand':106 'unprivileg':153,161,174 'use':222,230 'user':155,162,165 'via':97 'vulner':113 'want':3,30,38 'way':25 'will':131 'within':42,103,127 'without':16 'word':146 'would':120,198"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704677667
    +visibility: "visible             "
    +apId: "https://lemmy.ml/post/10216078"
    +editedAt: DateTimeImmutable @1712598393 {#2079
      date: 2024-04-08 19:46:33.0 +02:00
    }
    +createdAt: DateTimeImmutable @1704591267 {#2062
      date: 2024-01-07 02:34:27.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1734 …}
  +root: App\Entity\EntryComment {#1628}
  +body: "It’s the de-facto standard for runtime container security (sysdig is based on it). The only competitor afaik is aqua security’s tracee, which is way less mature. It is very well supporter, there are tons of rules maintained by the community and it is a CNCF project used by enterprise solutions (I.e., shouldn’t disappear overnight)."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 1
  +score: 0
  +lastActive: DateTime @1704690575 {#1736
    date: 2024-01-08 06:09:35.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@cyclohexane@lemmy.ml"
    "@sudneo@lemmy.world"
    "@krash@lemmy.ml"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1732 …}
  +nested: Doctrine\ORM\PersistentCollection {#1735 …}
  +votes: Doctrine\ORM\PersistentCollection {#1729 …}
  +reports: Doctrine\ORM\PersistentCollection {#1719 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1714 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1720 …}
  -id: 290565
  -bodyTs: "'afaik':20 'aqua':22 'base':14 'cncf':49 'communiti':44 'competitor':19 'contain':10 'de':5 'de-facto':4 'disappear':58 'enterpris':53 'facto':6 'i.e':55 'less':29 'maintain':41 'matur':30 'overnight':59 'project':50 'rule':40 'runtim':9 'secur':11,23 'shouldn':56 'solut':54 'standard':7 'support':35 'sysdig':12 'ton':38 'trace':25 'use':51 'way':28 'well':34"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6491825"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704690575 {#1730
    date: 2024-01-08 06:09:35.0 +01:00
  }
  +"title": 290565
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
20 DENIED moderate 
App\Entity\EntryComment {#1737
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1626
    +user: Proxies\__CG__\App\Entity\User {#2338 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2130 …}
    +slug: "How-to-secure-podman-or-docker-containers-for-public-facing-hosting"
    +title: "How to secure (podman or docker) containers for public-facing hosting?"
    +url: null
    +body: """
      Context\n
      -------\n
      \n
      I want to host public-facing applications on a server in my home, without compromising security. I realize containers might be one way to do this, and want to explore that route further.\n
      \n
      Requirements\n
      ------------\n
      \n
      I want to run applications within containers such that they\n
      \n
      - Must not be able to interfere with applications running on host\n
      - Must not be able to interfere with other containers or applications inside them\n
      - Must have no access or influence on other devices in the local network, or otherwise compromise the security of the network, but still accessible by devices via ssh.\n
      \n
      > Note: all of this within reason. I understand that sometimes there may be occasional vulnerabilities, like in kernel for example, that would eventually get fixed. Risks like this within reason I am willing to accept.\n
      \n
      What I found so far\n
      -------------------\n
      \n
      - **Running containers in rootless mode:** in other words, running the container daemon with an unprivileged host user\n
      - **Running applications in container under unprivileged users:** the container user under which the container is ran should be unprivileged\n
      - **Networking:** The container’s networking must be restricted. I am still not sure how to do this and shall explore it more, but would appreciate any resources.\n
      \n
      Alternative solution\n
      --------------------\n
      \n
      I have seen bubblewrap presented as an alternative, but it seems like it is not intended to be used directly in this manner, and information about using it for this is scarce.
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 21
    +favouriteCount: 83
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719138740 {#2337
      date: 2024-06-23 12:32:20.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2159 …}
    +votes: Doctrine\ORM\PersistentCollection {#2074 …}
    +reports: Doctrine\ORM\PersistentCollection {#2071 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2070 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2048 …}
    +badges: Doctrine\ORM\PersistentCollection {#2056 …}
    +children: [
      1 => App\Entity\EntryComment {#1628
        +user: App\Entity\User {#261 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1626 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
        +image: null
        +parent: null
        +root: null
        +body: """
          You already mentioned the most important things.\n
          \n
          I will add, at the cost of being pedantic:\n
          \n
          - build the image properly, or use good images. This means limit dependencies as much as possible, as minimal images as possible (less updates due to CVEs, less tooling).\n
          - do not mount host volumes, if you really have to, use a dedicated subpath owned by the user of the container. Do not use homedirs etc.\n
          - do not run in host namespaces, like host network etc. Use port mapping to send traffic to the container.\n
          \n
          If you want to go hardcore:\n
          \n
          - analyze your application, and if feasible, build and use a more restrictive seccomp profile compared to the default. This might limit additional syscalls that might be used during an exploitation but that your app doesn’t need.\n
          - run falco on the node. Even with the default set of rules (nothing custom), many exploitation or posts-exploitation steps would be caught, such as “shell spawned” etc.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 6
        +score: 0
        +lastActive: DateTime @1719122506 {#1630
          date: 2024-06-23 08:01:46.0 +02:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@cyclohexane@lemmy.ml"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1599 …}
        +nested: Doctrine\ORM\PersistentCollection {#1625 …}
        +votes: Doctrine\ORM\PersistentCollection {#1617 …}
        +reports: Doctrine\ORM\PersistentCollection {#1725 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1722 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1726 …}
        -id: 288266
        -bodyTs: "'add':10 'addit':117 'alreadi':2 'analyz':96 'app':129 'applic':98 'build':17,102 'caught':156 'compar':110 'contain':65,89 'cost':13 'custom':146 'cves':42 'dedic':57 'default':113,141 'depend':28 'doesn':130 'due':40 'etc':70,80,161 'even':138 'exploit':125,148,152 'falco':134 'feasibl':101 'go':94 'good':23 'hardcor':95 'homedir':69 'host':48,75,78 'imag':19,24,35 'import':6 'less':38,43 'like':77 'limit':27,116 'mani':147 'map':83 'mean':26 'mention':3 'might':115,120 'minim':34 'mount':47 'much':30 'namespac':76 'need':132 'network':79 'node':137 'noth':145 'own':59 'pedant':16 'port':82 'possibl':32,37 'post':151 'posts-exploit':150 'profil':109 'proper':20 'realli':52 'restrict':107 'rule':144 'run':73,133 'seccomp':108 'send':85 'set':142 'shell':159 'spawn':160 'step':153 'subpath':58 'syscal':118 'thing':7 'tool':44 'traffic':86 'updat':39 'use':22,55,68,81,104,122 'user':62 'volum':49 'want':92 'would':154"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6473668"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704620762 {#1629
          date: 2024-01-07 10:46:02.0 +01:00
        }
        +"title": 288266
      }
      0 => App\Entity\EntryComment {#1737}
    ]
    -id: 27753
    -titleTs: "'contain':7 'docker':6 'face':11 'host':12 'podman':4 'public':10 'public-fac':9 'secur':3"
    -bodyTs: "'abl':50,61 'accept':133 'access':74,94 'altern':202,211 'applic':9,41,54,68,157 'appreci':199 'bubblewrap':207 'compromis':17,86 'contain':21,43,66,140,149,159,164,169,177 'context':1 'daemon':150 'devic':79,96 'direct':223 'eventu':121 'exampl':118 'explor':32,194 'face':8 'far':138 'fix':123 'found':136 'get':122 'home':15 'host':5,57,154 'influenc':76 'inform':228 'insid':69 'intend':219 'interfer':52,63 'kernel':116 'like':114,125,215 'local':82 'manner':226 'may':110 'might':22 'mode':143 'must':47,58,71,180 'network':83,91,175,179 'note':99 'occasion':112 'one':24 'otherwis':85 'present':208 'public':7 'public-fac':6 'ran':171 'realiz':20 'reason':104,128 'requir':36 'resourc':201 'restrict':182 'risk':124 'rootless':142 'rout':34 'run':40,55,139,147,156 'scarc':235 'secur':18,88 'seem':214 'seen':206 'server':12 'shall':193 'solut':203 'sometim':108 'ssh':98 'still':93,185 'sure':187 'understand':106 'unprivileg':153,161,174 'use':222,230 'user':155,162,165 'via':97 'vulner':113 'want':3,30,38 'way':25 'will':131 'within':42,103,127 'without':16 'word':146 'would':120,198"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704677667
    +visibility: "visible             "
    +apId: "https://lemmy.ml/post/10216078"
    +editedAt: DateTimeImmutable @1712598393 {#2079
      date: 2024-04-08 19:46:33.0 +02:00
    }
    +createdAt: DateTimeImmutable @1704591267 {#2062
      date: 2024-01-07 02:34:27.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1734 …}
  +root: App\Entity\EntryComment {#1628}
  +body: "It’s the de-facto standard for runtime container security (sysdig is based on it). The only competitor afaik is aqua security’s tracee, which is way less mature. It is very well supporter, there are tons of rules maintained by the community and it is a CNCF project used by enterprise solutions (I.e., shouldn’t disappear overnight)."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 1
  +score: 0
  +lastActive: DateTime @1704690575 {#1736
    date: 2024-01-08 06:09:35.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@cyclohexane@lemmy.ml"
    "@sudneo@lemmy.world"
    "@krash@lemmy.ml"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1732 …}
  +nested: Doctrine\ORM\PersistentCollection {#1735 …}
  +votes: Doctrine\ORM\PersistentCollection {#1729 …}
  +reports: Doctrine\ORM\PersistentCollection {#1719 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1714 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1720 …}
  -id: 290565
  -bodyTs: "'afaik':20 'aqua':22 'base':14 'cncf':49 'communiti':44 'competitor':19 'contain':10 'de':5 'de-facto':4 'disappear':58 'enterpris':53 'facto':6 'i.e':55 'less':29 'maintain':41 'matur':30 'overnight':59 'project':50 'rule':40 'runtim':9 'secur':11,23 'shouldn':56 'solut':54 'standard':7 'support':35 'sysdig':12 'ton':38 'trace':25 'use':51 'way':28 'well':34"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6491825"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704690575 {#1730
    date: 2024-01-08 06:09:35.0 +01:00
  }
  +"title": 290565
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
21 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
22 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1619
  +user: Proxies\__CG__\App\Entity\User {#2055 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
  +image: Proxies\__CG__\App\Entity\Image {#2107 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2110 …}
  +slug: "Stalwart-v0-5-0"
  +title: "Stalwart v0.5.0"
  +url: "https://stalw.art/blog/storage-performance/"
  +body: """
    **Elevating Performance and Flexibility**\n
    \n
    We are excited to announce the release of Stalwart Mail Server v0.5.0. As we approach the end of the year, this significant update marks a major advancement in our journey to provide a robust, efficient, and versatile mail server solution. This latest version incorporates a range of performance enhancements, storage layer improvements, and new features, designed to elevate your email server experience.
    """
  +type: "link"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 40
  +favouriteCount: 119
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1720677469 {#2046
    date: 2024-07-11 07:57:49.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2106 …}
  +votes: Doctrine\ORM\PersistentCollection {#2117 …}
  +reports: Doctrine\ORM\PersistentCollection {#2112 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2118 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2122 …}
  +badges: Doctrine\ORM\PersistentCollection {#2113 …}
  +children: [
    App\Entity\EntryComment {#1596
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1619 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1701 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1683 …}
      +body: """
        I don’t think it’s you, it generally is a bad practice to have multiple processes inside a container. It usually defeats most of the isolation, introduces problems with handling zombie processes (therefore you need an init) and restarting tools when they crash (then you need something like supervisord, which I guess this image might use - I didn’t check). Each software adds dependencies, which can conflict (again defeating the idea of containers), and of course CVEs. Then you have a problem with users etc.\n
        \n
        So yeah, containers are generally not meant to be used this way. The project might be cool but I would be very uncomfortable running it like this, especially if that’s going to be my primary email, with all the password resetting capabilities etc.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 7
      +score: 0
      +lastActive: DateTime @1703756461 {#1613
        date: 2023-12-28 10:41:01.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@Parachute4196@lemmy.world"
        "@eskuero@lemmy.fromshado.ws"
        "@ikidd@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1687 …}
      +nested: Doctrine\ORM\PersistentCollection {#1689 …}
      +votes: Doctrine\ORM\PersistentCollection {#1691 …}
      +reports: Doctrine\ORM\PersistentCollection {#1795 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1711 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1611 …}
      -id: 258804
      -bodyTs: "'add':64 'bad':12 'capabl':129 'check':61 'conflict':68 'contain':20,74,89 'cool':103 'cours':77 'crash':44 'cves':78 'defeat':23,70 'depend':65 'didn':59 'email':123 'especi':114 'etc':86,130 'general':9,91 'go':118 'guess':53 'handl':31 'idea':72 'imag':55 'init':38 'insid':18 'introduc':28 'isol':27 'like':49,112 'meant':93 'might':56,101 'multipl':16 'need':36,47 'password':127 'practic':13 'primari':122 'problem':29,83 'process':17,33 'project':100 'reset':128 'restart':40 'run':110 'softwar':63 'someth':48 'supervisord':50 'therefor':34 'think':4 'tool':41 'uncomfort':109 'use':57,96 'user':85 'usual':22 'way':98 'would':106 'yeah':88 'zombi':32"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6274200"
      +editedAt: null
      +createdAt: DateTimeImmutable @1703756461 {#1604
        date: 2023-12-28 10:41:01.0 +01:00
      }
      +"title": 258804
    }
  ]
  -id: 25264
  -titleTs: "'stalwart':1 'v0.5.0':2"
  -bodyTs: "'advanc':31 'announc':9 'approach':19 'design':60 'effici':39 'elev':1,62 'email':64 'end':21 'enhanc':53 'excit':7 'experi':66 'featur':59 'flexibl':4 'improv':56 'incorpor':48 'journey':34 'latest':46 'layer':55 'mail':14,42 'major':30 'mark':28 'new':58 'perform':2,52 'provid':36 'rang':50 'releas':11 'robust':38 'server':15,43,65 'signific':26 'solut':44 'stalwart':13 'storag':54 'updat':27 'v0.5.0':16 'versatil':41 'version':47 'year':24"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1703792857
  +visibility: "visible             "
  +apId: "https://lemmy.world/post/10034802"
  +editedAt: DateTimeImmutable @1708508842 {#2135
    date: 2024-02-21 10:47:22.0 +01:00
  }
  +createdAt: DateTimeImmutable @1703706457 {#2096
    date: 2023-12-27 20:47:37.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
23 DENIED edit 
Proxies\__CG__\App\Entity\Entry {#1619
  +user: Proxies\__CG__\App\Entity\User {#2055 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
  +image: Proxies\__CG__\App\Entity\Image {#2107 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2110 …}
  +slug: "Stalwart-v0-5-0"
  +title: "Stalwart v0.5.0"
  +url: "https://stalw.art/blog/storage-performance/"
  +body: """
    **Elevating Performance and Flexibility**\n
    \n
    We are excited to announce the release of Stalwart Mail Server v0.5.0. As we approach the end of the year, this significant update marks a major advancement in our journey to provide a robust, efficient, and versatile mail server solution. This latest version incorporates a range of performance enhancements, storage layer improvements, and new features, designed to elevate your email server experience.
    """
  +type: "link"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 40
  +favouriteCount: 119
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1720677469 {#2046
    date: 2024-07-11 07:57:49.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2106 …}
  +votes: Doctrine\ORM\PersistentCollection {#2117 …}
  +reports: Doctrine\ORM\PersistentCollection {#2112 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2118 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2122 …}
  +badges: Doctrine\ORM\PersistentCollection {#2113 …}
  +children: [
    App\Entity\EntryComment {#1596
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1619 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1701 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1683 …}
      +body: """
        I don’t think it’s you, it generally is a bad practice to have multiple processes inside a container. It usually defeats most of the isolation, introduces problems with handling zombie processes (therefore you need an init) and restarting tools when they crash (then you need something like supervisord, which I guess this image might use - I didn’t check). Each software adds dependencies, which can conflict (again defeating the idea of containers), and of course CVEs. Then you have a problem with users etc.\n
        \n
        So yeah, containers are generally not meant to be used this way. The project might be cool but I would be very uncomfortable running it like this, especially if that’s going to be my primary email, with all the password resetting capabilities etc.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 7
      +score: 0
      +lastActive: DateTime @1703756461 {#1613
        date: 2023-12-28 10:41:01.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@Parachute4196@lemmy.world"
        "@eskuero@lemmy.fromshado.ws"
        "@ikidd@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1687 …}
      +nested: Doctrine\ORM\PersistentCollection {#1689 …}
      +votes: Doctrine\ORM\PersistentCollection {#1691 …}
      +reports: Doctrine\ORM\PersistentCollection {#1795 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1711 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1611 …}
      -id: 258804
      -bodyTs: "'add':64 'bad':12 'capabl':129 'check':61 'conflict':68 'contain':20,74,89 'cool':103 'cours':77 'crash':44 'cves':78 'defeat':23,70 'depend':65 'didn':59 'email':123 'especi':114 'etc':86,130 'general':9,91 'go':118 'guess':53 'handl':31 'idea':72 'imag':55 'init':38 'insid':18 'introduc':28 'isol':27 'like':49,112 'meant':93 'might':56,101 'multipl':16 'need':36,47 'password':127 'practic':13 'primari':122 'problem':29,83 'process':17,33 'project':100 'reset':128 'restart':40 'run':110 'softwar':63 'someth':48 'supervisord':50 'therefor':34 'think':4 'tool':41 'uncomfort':109 'use':57,96 'user':85 'usual':22 'way':98 'would':106 'yeah':88 'zombi':32"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6274200"
      +editedAt: null
      +createdAt: DateTimeImmutable @1703756461 {#1604
        date: 2023-12-28 10:41:01.0 +01:00
      }
      +"title": 258804
    }
  ]
  -id: 25264
  -titleTs: "'stalwart':1 'v0.5.0':2"
  -bodyTs: "'advanc':31 'announc':9 'approach':19 'design':60 'effici':39 'elev':1,62 'email':64 'end':21 'enhanc':53 'excit':7 'experi':66 'featur':59 'flexibl':4 'improv':56 'incorpor':48 'journey':34 'latest':46 'layer':55 'mail':14,42 'major':30 'mark':28 'new':58 'perform':2,52 'provid':36 'rang':50 'releas':11 'robust':38 'server':15,43,65 'signific':26 'solut':44 'stalwart':13 'storag':54 'updat':27 'v0.5.0':16 'versatil':41 'version':47 'year':24"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1703792857
  +visibility: "visible             "
  +apId: "https://lemmy.world/post/10034802"
  +editedAt: DateTimeImmutable @1708508842 {#2135
    date: 2024-02-21 10:47:22.0 +01:00
  }
  +createdAt: DateTimeImmutable @1703706457 {#2096
    date: 2023-12-27 20:47:37.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
24 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1619
  +user: Proxies\__CG__\App\Entity\User {#2055 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
  +image: Proxies\__CG__\App\Entity\Image {#2107 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2110 …}
  +slug: "Stalwart-v0-5-0"
  +title: "Stalwart v0.5.0"
  +url: "https://stalw.art/blog/storage-performance/"
  +body: """
    **Elevating Performance and Flexibility**\n
    \n
    We are excited to announce the release of Stalwart Mail Server v0.5.0. As we approach the end of the year, this significant update marks a major advancement in our journey to provide a robust, efficient, and versatile mail server solution. This latest version incorporates a range of performance enhancements, storage layer improvements, and new features, designed to elevate your email server experience.
    """
  +type: "link"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 40
  +favouriteCount: 119
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1720677469 {#2046
    date: 2024-07-11 07:57:49.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2106 …}
  +votes: Doctrine\ORM\PersistentCollection {#2117 …}
  +reports: Doctrine\ORM\PersistentCollection {#2112 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2118 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2122 …}
  +badges: Doctrine\ORM\PersistentCollection {#2113 …}
  +children: [
    App\Entity\EntryComment {#1596
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1619 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1701 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1683 …}
      +body: """
        I don’t think it’s you, it generally is a bad practice to have multiple processes inside a container. It usually defeats most of the isolation, introduces problems with handling zombie processes (therefore you need an init) and restarting tools when they crash (then you need something like supervisord, which I guess this image might use - I didn’t check). Each software adds dependencies, which can conflict (again defeating the idea of containers), and of course CVEs. Then you have a problem with users etc.\n
        \n
        So yeah, containers are generally not meant to be used this way. The project might be cool but I would be very uncomfortable running it like this, especially if that’s going to be my primary email, with all the password resetting capabilities etc.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 7
      +score: 0
      +lastActive: DateTime @1703756461 {#1613
        date: 2023-12-28 10:41:01.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@Parachute4196@lemmy.world"
        "@eskuero@lemmy.fromshado.ws"
        "@ikidd@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1687 …}
      +nested: Doctrine\ORM\PersistentCollection {#1689 …}
      +votes: Doctrine\ORM\PersistentCollection {#1691 …}
      +reports: Doctrine\ORM\PersistentCollection {#1795 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1711 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1611 …}
      -id: 258804
      -bodyTs: "'add':64 'bad':12 'capabl':129 'check':61 'conflict':68 'contain':20,74,89 'cool':103 'cours':77 'crash':44 'cves':78 'defeat':23,70 'depend':65 'didn':59 'email':123 'especi':114 'etc':86,130 'general':9,91 'go':118 'guess':53 'handl':31 'idea':72 'imag':55 'init':38 'insid':18 'introduc':28 'isol':27 'like':49,112 'meant':93 'might':56,101 'multipl':16 'need':36,47 'password':127 'practic':13 'primari':122 'problem':29,83 'process':17,33 'project':100 'reset':128 'restart':40 'run':110 'softwar':63 'someth':48 'supervisord':50 'therefor':34 'think':4 'tool':41 'uncomfort':109 'use':57,96 'user':85 'usual':22 'way':98 'would':106 'yeah':88 'zombi':32"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6274200"
      +editedAt: null
      +createdAt: DateTimeImmutable @1703756461 {#1604
        date: 2023-12-28 10:41:01.0 +01:00
      }
      +"title": 258804
    }
  ]
  -id: 25264
  -titleTs: "'stalwart':1 'v0.5.0':2"
  -bodyTs: "'advanc':31 'announc':9 'approach':19 'design':60 'effici':39 'elev':1,62 'email':64 'end':21 'enhanc':53 'excit':7 'experi':66 'featur':59 'flexibl':4 'improv':56 'incorpor':48 'journey':34 'latest':46 'layer':55 'mail':14,42 'major':30 'mark':28 'new':58 'perform':2,52 'provid':36 'rang':50 'releas':11 'robust':38 'server':15,43,65 'signific':26 'solut':44 'stalwart':13 'storag':54 'updat':27 'v0.5.0':16 'versatil':41 'version':47 'year':24"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1703792857
  +visibility: "visible             "
  +apId: "https://lemmy.world/post/10034802"
  +editedAt: DateTimeImmutable @1708508842 {#2135
    date: 2024-02-21 10:47:22.0 +01:00
  }
  +createdAt: DateTimeImmutable @1703706457 {#2096
    date: 2023-12-27 20:47:37.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
25 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
26 DENIED moderate 
App\Entity\EntryComment {#1596
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1619
    +user: Proxies\__CG__\App\Entity\User {#2055 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
    +image: Proxies\__CG__\App\Entity\Image {#2107 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2110 …}
    +slug: "Stalwart-v0-5-0"
    +title: "Stalwart v0.5.0"
    +url: "https://stalw.art/blog/storage-performance/"
    +body: """
      **Elevating Performance and Flexibility**\n
      \n
      We are excited to announce the release of Stalwart Mail Server v0.5.0. As we approach the end of the year, this significant update marks a major advancement in our journey to provide a robust, efficient, and versatile mail server solution. This latest version incorporates a range of performance enhancements, storage layer improvements, and new features, designed to elevate your email server experience.
      """
    +type: "link"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 40
    +favouriteCount: 119
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1720677469 {#2046
      date: 2024-07-11 07:57:49.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2106 …}
    +votes: Doctrine\ORM\PersistentCollection {#2117 …}
    +reports: Doctrine\ORM\PersistentCollection {#2112 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2118 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2122 …}
    +badges: Doctrine\ORM\PersistentCollection {#2113 …}
    +children: [
      App\Entity\EntryComment {#1596}
    ]
    -id: 25264
    -titleTs: "'stalwart':1 'v0.5.0':2"
    -bodyTs: "'advanc':31 'announc':9 'approach':19 'design':60 'effici':39 'elev':1,62 'email':64 'end':21 'enhanc':53 'excit':7 'experi':66 'featur':59 'flexibl':4 'improv':56 'incorpor':48 'journey':34 'latest':46 'layer':55 'mail':14,42 'major':30 'mark':28 'new':58 'perform':2,52 'provid':36 'rang':50 'releas':11 'robust':38 'server':15,43,65 'signific':26 'solut':44 'stalwart':13 'storag':54 'updat':27 'v0.5.0':16 'versatil':41 'version':47 'year':24"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1703792857
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10034802"
    +editedAt: DateTimeImmutable @1708508842 {#2135
      date: 2024-02-21 10:47:22.0 +01:00
    }
    +createdAt: DateTimeImmutable @1703706457 {#2096
      date: 2023-12-27 20:47:37.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1701 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1683 …}
  +body: """
    I don’t think it’s you, it generally is a bad practice to have multiple processes inside a container. It usually defeats most of the isolation, introduces problems with handling zombie processes (therefore you need an init) and restarting tools when they crash (then you need something like supervisord, which I guess this image might use - I didn’t check). Each software adds dependencies, which can conflict (again defeating the idea of containers), and of course CVEs. Then you have a problem with users etc.\n
    \n
    So yeah, containers are generally not meant to be used this way. The project might be cool but I would be very uncomfortable running it like this, especially if that’s going to be my primary email, with all the password resetting capabilities etc.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 7
  +score: 0
  +lastActive: DateTime @1703756461 {#1613
    date: 2023-12-28 10:41:01.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Parachute4196@lemmy.world"
    "@eskuero@lemmy.fromshado.ws"
    "@ikidd@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1687 …}
  +nested: Doctrine\ORM\PersistentCollection {#1689 …}
  +votes: Doctrine\ORM\PersistentCollection {#1691 …}
  +reports: Doctrine\ORM\PersistentCollection {#1795 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1711 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1611 …}
  -id: 258804
  -bodyTs: "'add':64 'bad':12 'capabl':129 'check':61 'conflict':68 'contain':20,74,89 'cool':103 'cours':77 'crash':44 'cves':78 'defeat':23,70 'depend':65 'didn':59 'email':123 'especi':114 'etc':86,130 'general':9,91 'go':118 'guess':53 'handl':31 'idea':72 'imag':55 'init':38 'insid':18 'introduc':28 'isol':27 'like':49,112 'meant':93 'might':56,101 'multipl':16 'need':36,47 'password':127 'practic':13 'primari':122 'problem':29,83 'process':17,33 'project':100 'reset':128 'restart':40 'run':110 'softwar':63 'someth':48 'supervisord':50 'therefor':34 'think':4 'tool':41 'uncomfort':109 'use':57,96 'user':85 'usual':22 'way':98 'would':106 'yeah':88 'zombi':32"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6274200"
  +editedAt: null
  +createdAt: DateTimeImmutable @1703756461 {#1604
    date: 2023-12-28 10:41:01.0 +01:00
  }
  +"title": 258804
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
27 DENIED edit 
App\Entity\EntryComment {#1596
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1619
    +user: Proxies\__CG__\App\Entity\User {#2055 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
    +image: Proxies\__CG__\App\Entity\Image {#2107 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2110 …}
    +slug: "Stalwart-v0-5-0"
    +title: "Stalwart v0.5.0"
    +url: "https://stalw.art/blog/storage-performance/"
    +body: """
      **Elevating Performance and Flexibility**\n
      \n
      We are excited to announce the release of Stalwart Mail Server v0.5.0. As we approach the end of the year, this significant update marks a major advancement in our journey to provide a robust, efficient, and versatile mail server solution. This latest version incorporates a range of performance enhancements, storage layer improvements, and new features, designed to elevate your email server experience.
      """
    +type: "link"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 40
    +favouriteCount: 119
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1720677469 {#2046
      date: 2024-07-11 07:57:49.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2106 …}
    +votes: Doctrine\ORM\PersistentCollection {#2117 …}
    +reports: Doctrine\ORM\PersistentCollection {#2112 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2118 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2122 …}
    +badges: Doctrine\ORM\PersistentCollection {#2113 …}
    +children: [
      App\Entity\EntryComment {#1596}
    ]
    -id: 25264
    -titleTs: "'stalwart':1 'v0.5.0':2"
    -bodyTs: "'advanc':31 'announc':9 'approach':19 'design':60 'effici':39 'elev':1,62 'email':64 'end':21 'enhanc':53 'excit':7 'experi':66 'featur':59 'flexibl':4 'improv':56 'incorpor':48 'journey':34 'latest':46 'layer':55 'mail':14,42 'major':30 'mark':28 'new':58 'perform':2,52 'provid':36 'rang':50 'releas':11 'robust':38 'server':15,43,65 'signific':26 'solut':44 'stalwart':13 'storag':54 'updat':27 'v0.5.0':16 'versatil':41 'version':47 'year':24"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1703792857
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10034802"
    +editedAt: DateTimeImmutable @1708508842 {#2135
      date: 2024-02-21 10:47:22.0 +01:00
    }
    +createdAt: DateTimeImmutable @1703706457 {#2096
      date: 2023-12-27 20:47:37.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1701 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1683 …}
  +body: """
    I don’t think it’s you, it generally is a bad practice to have multiple processes inside a container. It usually defeats most of the isolation, introduces problems with handling zombie processes (therefore you need an init) and restarting tools when they crash (then you need something like supervisord, which I guess this image might use - I didn’t check). Each software adds dependencies, which can conflict (again defeating the idea of containers), and of course CVEs. Then you have a problem with users etc.\n
    \n
    So yeah, containers are generally not meant to be used this way. The project might be cool but I would be very uncomfortable running it like this, especially if that’s going to be my primary email, with all the password resetting capabilities etc.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 7
  +score: 0
  +lastActive: DateTime @1703756461 {#1613
    date: 2023-12-28 10:41:01.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Parachute4196@lemmy.world"
    "@eskuero@lemmy.fromshado.ws"
    "@ikidd@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1687 …}
  +nested: Doctrine\ORM\PersistentCollection {#1689 …}
  +votes: Doctrine\ORM\PersistentCollection {#1691 …}
  +reports: Doctrine\ORM\PersistentCollection {#1795 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1711 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1611 …}
  -id: 258804
  -bodyTs: "'add':64 'bad':12 'capabl':129 'check':61 'conflict':68 'contain':20,74,89 'cool':103 'cours':77 'crash':44 'cves':78 'defeat':23,70 'depend':65 'didn':59 'email':123 'especi':114 'etc':86,130 'general':9,91 'go':118 'guess':53 'handl':31 'idea':72 'imag':55 'init':38 'insid':18 'introduc':28 'isol':27 'like':49,112 'meant':93 'might':56,101 'multipl':16 'need':36,47 'password':127 'practic':13 'primari':122 'problem':29,83 'process':17,33 'project':100 'reset':128 'restart':40 'run':110 'softwar':63 'someth':48 'supervisord':50 'therefor':34 'think':4 'tool':41 'uncomfort':109 'use':57,96 'user':85 'usual':22 'way':98 'would':106 'yeah':88 'zombi':32"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6274200"
  +editedAt: null
  +createdAt: DateTimeImmutable @1703756461 {#1604
    date: 2023-12-28 10:41:01.0 +01:00
  }
  +"title": 258804
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
28 DENIED moderate 
App\Entity\EntryComment {#1596
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1619
    +user: Proxies\__CG__\App\Entity\User {#2055 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
    +image: Proxies\__CG__\App\Entity\Image {#2107 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2110 …}
    +slug: "Stalwart-v0-5-0"
    +title: "Stalwart v0.5.0"
    +url: "https://stalw.art/blog/storage-performance/"
    +body: """
      **Elevating Performance and Flexibility**\n
      \n
      We are excited to announce the release of Stalwart Mail Server v0.5.0. As we approach the end of the year, this significant update marks a major advancement in our journey to provide a robust, efficient, and versatile mail server solution. This latest version incorporates a range of performance enhancements, storage layer improvements, and new features, designed to elevate your email server experience.
      """
    +type: "link"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 40
    +favouriteCount: 119
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1720677469 {#2046
      date: 2024-07-11 07:57:49.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2106 …}
    +votes: Doctrine\ORM\PersistentCollection {#2117 …}
    +reports: Doctrine\ORM\PersistentCollection {#2112 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2118 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2122 …}
    +badges: Doctrine\ORM\PersistentCollection {#2113 …}
    +children: [
      App\Entity\EntryComment {#1596}
    ]
    -id: 25264
    -titleTs: "'stalwart':1 'v0.5.0':2"
    -bodyTs: "'advanc':31 'announc':9 'approach':19 'design':60 'effici':39 'elev':1,62 'email':64 'end':21 'enhanc':53 'excit':7 'experi':66 'featur':59 'flexibl':4 'improv':56 'incorpor':48 'journey':34 'latest':46 'layer':55 'mail':14,42 'major':30 'mark':28 'new':58 'perform':2,52 'provid':36 'rang':50 'releas':11 'robust':38 'server':15,43,65 'signific':26 'solut':44 'stalwart':13 'storag':54 'updat':27 'v0.5.0':16 'versatil':41 'version':47 'year':24"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1703792857
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10034802"
    +editedAt: DateTimeImmutable @1708508842 {#2135
      date: 2024-02-21 10:47:22.0 +01:00
    }
    +createdAt: DateTimeImmutable @1703706457 {#2096
      date: 2023-12-27 20:47:37.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1702 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1701 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1683 …}
  +body: """
    I don’t think it’s you, it generally is a bad practice to have multiple processes inside a container. It usually defeats most of the isolation, introduces problems with handling zombie processes (therefore you need an init) and restarting tools when they crash (then you need something like supervisord, which I guess this image might use - I didn’t check). Each software adds dependencies, which can conflict (again defeating the idea of containers), and of course CVEs. Then you have a problem with users etc.\n
    \n
    So yeah, containers are generally not meant to be used this way. The project might be cool but I would be very uncomfortable running it like this, especially if that’s going to be my primary email, with all the password resetting capabilities etc.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 7
  +score: 0
  +lastActive: DateTime @1703756461 {#1613
    date: 2023-12-28 10:41:01.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Parachute4196@lemmy.world"
    "@eskuero@lemmy.fromshado.ws"
    "@ikidd@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1687 …}
  +nested: Doctrine\ORM\PersistentCollection {#1689 …}
  +votes: Doctrine\ORM\PersistentCollection {#1691 …}
  +reports: Doctrine\ORM\PersistentCollection {#1795 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1711 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1611 …}
  -id: 258804
  -bodyTs: "'add':64 'bad':12 'capabl':129 'check':61 'conflict':68 'contain':20,74,89 'cool':103 'cours':77 'crash':44 'cves':78 'defeat':23,70 'depend':65 'didn':59 'email':123 'especi':114 'etc':86,130 'general':9,91 'go':118 'guess':53 'handl':31 'idea':72 'imag':55 'init':38 'insid':18 'introduc':28 'isol':27 'like':49,112 'meant':93 'might':56,101 'multipl':16 'need':36,47 'password':127 'practic':13 'primari':122 'problem':29,83 'process':17,33 'project':100 'reset':128 'restart':40 'run':110 'softwar':63 'someth':48 'supervisord':50 'therefor':34 'think':4 'tool':41 'uncomfort':109 'use':57,96 'user':85 'usual':22 'way':98 'would':106 'yeah':88 'zombi':32"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6274200"
  +editedAt: null
  +createdAt: DateTimeImmutable @1703756461 {#1604
    date: 2023-12-28 10:41:01.0 +01:00
  }
  +"title": 258804
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
29 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
30 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1559
  +user: Proxies\__CG__\App\Entity\User {#2073 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2163 …}
  +slug: "Proton-Drive-Camera-Backup-has-Arrived"
  +title: "Proton Drive Camera Backup has Arrived!"
  +url: "https://proton.me/support/enable-photo-backup"
  +body: "This has been one of the key features I’ve been waiting for to finally be able to move away from Google Photos and OneDrive for mobile photos backup."
  +type: "link"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 9
  +favouriteCount: 107
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1702185373 {#2119
    date: 2023-12-10 06:16:13.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2044 …}
  +votes: Doctrine\ORM\PersistentCollection {#2127 …}
  +reports: Doctrine\ORM\PersistentCollection {#2043 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2215 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2198 …}
  +badges: Doctrine\ORM\PersistentCollection {#2227 …}
  +children: [
    App\Entity\EntryComment {#1564
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1559 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
      +image: null
      +parent: null
      +root: null
      +body: "Thanks for sharing, I was not aware of it, and it worked like a charm."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 3
      +score: 0
      +lastActive: DateTime @1702054271 {#1584
        date: 2023-12-08 17:51:11.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@OminousOrange@lemmy.ca"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1567 …}
      +nested: Doctrine\ORM\PersistentCollection {#1563 …}
      +votes: Doctrine\ORM\PersistentCollection {#1565 …}
      +reports: Doctrine\ORM\PersistentCollection {#1558 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1557 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1621 …}
      -id: 211123
      -bodyTs: "'awar':7 'charm':15 'like':13 'share':3 'thank':1 'work':12"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/5899794"
      +editedAt: null
      +createdAt: DateTimeImmutable @1702054271 {#1548
        date: 2023-12-08 17:51:11.0 +01:00
      }
      +"title": 211123
    }
  ]
  -id: 21188
  -titleTs: "'arriv':6 'backup':4 'camera':3 'drive':2 'proton':1"
  -bodyTs: "'abl':17 'away':20 'backup':29 'featur':8 'final':15 'googl':22 'key':7 'mobil':27 'move':19 'one':4 'onedr':25 'photo':23,28 've':10 'wait':12"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1702132508
  +visibility: "visible             "
  +apId: "https://lemmy.ca/post/10899393"
  +editedAt: null
  +createdAt: DateTimeImmutable @1702046108 {#2052
    date: 2023-12-08 15:35:08.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
31 DENIED edit 
Proxies\__CG__\App\Entity\Entry {#1559
  +user: Proxies\__CG__\App\Entity\User {#2073 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2163 …}
  +slug: "Proton-Drive-Camera-Backup-has-Arrived"
  +title: "Proton Drive Camera Backup has Arrived!"
  +url: "https://proton.me/support/enable-photo-backup"
  +body: "This has been one of the key features I’ve been waiting for to finally be able to move away from Google Photos and OneDrive for mobile photos backup."
  +type: "link"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 9
  +favouriteCount: 107
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1702185373 {#2119
    date: 2023-12-10 06:16:13.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2044 …}
  +votes: Doctrine\ORM\PersistentCollection {#2127 …}
  +reports: Doctrine\ORM\PersistentCollection {#2043 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2215 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2198 …}
  +badges: Doctrine\ORM\PersistentCollection {#2227 …}
  +children: [
    App\Entity\EntryComment {#1564
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1559 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
      +image: null
      +parent: null
      +root: null
      +body: "Thanks for sharing, I was not aware of it, and it worked like a charm."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 3
      +score: 0
      +lastActive: DateTime @1702054271 {#1584
        date: 2023-12-08 17:51:11.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@OminousOrange@lemmy.ca"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1567 …}
      +nested: Doctrine\ORM\PersistentCollection {#1563 …}
      +votes: Doctrine\ORM\PersistentCollection {#1565 …}
      +reports: Doctrine\ORM\PersistentCollection {#1558 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1557 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1621 …}
      -id: 211123
      -bodyTs: "'awar':7 'charm':15 'like':13 'share':3 'thank':1 'work':12"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/5899794"
      +editedAt: null
      +createdAt: DateTimeImmutable @1702054271 {#1548
        date: 2023-12-08 17:51:11.0 +01:00
      }
      +"title": 211123
    }
  ]
  -id: 21188
  -titleTs: "'arriv':6 'backup':4 'camera':3 'drive':2 'proton':1"
  -bodyTs: "'abl':17 'away':20 'backup':29 'featur':8 'final':15 'googl':22 'key':7 'mobil':27 'move':19 'one':4 'onedr':25 'photo':23,28 've':10 'wait':12"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1702132508
  +visibility: "visible             "
  +apId: "https://lemmy.ca/post/10899393"
  +editedAt: null
  +createdAt: DateTimeImmutable @1702046108 {#2052
    date: 2023-12-08 15:35:08.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
32 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1559
  +user: Proxies\__CG__\App\Entity\User {#2073 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2163 …}
  +slug: "Proton-Drive-Camera-Backup-has-Arrived"
  +title: "Proton Drive Camera Backup has Arrived!"
  +url: "https://proton.me/support/enable-photo-backup"
  +body: "This has been one of the key features I’ve been waiting for to finally be able to move away from Google Photos and OneDrive for mobile photos backup."
  +type: "link"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 9
  +favouriteCount: 107
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1702185373 {#2119
    date: 2023-12-10 06:16:13.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2044 …}
  +votes: Doctrine\ORM\PersistentCollection {#2127 …}
  +reports: Doctrine\ORM\PersistentCollection {#2043 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2215 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2198 …}
  +badges: Doctrine\ORM\PersistentCollection {#2227 …}
  +children: [
    App\Entity\EntryComment {#1564
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1559 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
      +image: null
      +parent: null
      +root: null
      +body: "Thanks for sharing, I was not aware of it, and it worked like a charm."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 3
      +score: 0
      +lastActive: DateTime @1702054271 {#1584
        date: 2023-12-08 17:51:11.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@OminousOrange@lemmy.ca"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1567 …}
      +nested: Doctrine\ORM\PersistentCollection {#1563 …}
      +votes: Doctrine\ORM\PersistentCollection {#1565 …}
      +reports: Doctrine\ORM\PersistentCollection {#1558 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1557 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1621 …}
      -id: 211123
      -bodyTs: "'awar':7 'charm':15 'like':13 'share':3 'thank':1 'work':12"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/5899794"
      +editedAt: null
      +createdAt: DateTimeImmutable @1702054271 {#1548
        date: 2023-12-08 17:51:11.0 +01:00
      }
      +"title": 211123
    }
  ]
  -id: 21188
  -titleTs: "'arriv':6 'backup':4 'camera':3 'drive':2 'proton':1"
  -bodyTs: "'abl':17 'away':20 'backup':29 'featur':8 'final':15 'googl':22 'key':7 'mobil':27 'move':19 'one':4 'onedr':25 'photo':23,28 've':10 'wait':12"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1702132508
  +visibility: "visible             "
  +apId: "https://lemmy.ca/post/10899393"
  +editedAt: null
  +createdAt: DateTimeImmutable @1702046108 {#2052
    date: 2023-12-08 15:35:08.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
33 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
34 DENIED moderate 
App\Entity\EntryComment {#1564
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1559
    +user: Proxies\__CG__\App\Entity\User {#2073 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2163 …}
    +slug: "Proton-Drive-Camera-Backup-has-Arrived"
    +title: "Proton Drive Camera Backup has Arrived!"
    +url: "https://proton.me/support/enable-photo-backup"
    +body: "This has been one of the key features I’ve been waiting for to finally be able to move away from Google Photos and OneDrive for mobile photos backup."
    +type: "link"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 9
    +favouriteCount: 107
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1702185373 {#2119
      date: 2023-12-10 06:16:13.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2044 …}
    +votes: Doctrine\ORM\PersistentCollection {#2127 …}
    +reports: Doctrine\ORM\PersistentCollection {#2043 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2215 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2198 …}
    +badges: Doctrine\ORM\PersistentCollection {#2227 …}
    +children: [
      App\Entity\EntryComment {#1564}
    ]
    -id: 21188
    -titleTs: "'arriv':6 'backup':4 'camera':3 'drive':2 'proton':1"
    -bodyTs: "'abl':17 'away':20 'backup':29 'featur':8 'final':15 'googl':22 'key':7 'mobil':27 'move':19 'one':4 'onedr':25 'photo':23,28 've':10 'wait':12"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1702132508
    +visibility: "visible             "
    +apId: "https://lemmy.ca/post/10899393"
    +editedAt: null
    +createdAt: DateTimeImmutable @1702046108 {#2052
      date: 2023-12-08 15:35:08.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
  +image: null
  +parent: null
  +root: null
  +body: "Thanks for sharing, I was not aware of it, and it worked like a charm."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 3
  +score: 0
  +lastActive: DateTime @1702054271 {#1584
    date: 2023-12-08 17:51:11.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@OminousOrange@lemmy.ca"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1567 …}
  +nested: Doctrine\ORM\PersistentCollection {#1563 …}
  +votes: Doctrine\ORM\PersistentCollection {#1565 …}
  +reports: Doctrine\ORM\PersistentCollection {#1558 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1557 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1621 …}
  -id: 211123
  -bodyTs: "'awar':7 'charm':15 'like':13 'share':3 'thank':1 'work':12"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5899794"
  +editedAt: null
  +createdAt: DateTimeImmutable @1702054271 {#1548
    date: 2023-12-08 17:51:11.0 +01:00
  }
  +"title": 211123
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
35 DENIED edit 
App\Entity\EntryComment {#1564
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1559
    +user: Proxies\__CG__\App\Entity\User {#2073 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2163 …}
    +slug: "Proton-Drive-Camera-Backup-has-Arrived"
    +title: "Proton Drive Camera Backup has Arrived!"
    +url: "https://proton.me/support/enable-photo-backup"
    +body: "This has been one of the key features I’ve been waiting for to finally be able to move away from Google Photos and OneDrive for mobile photos backup."
    +type: "link"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 9
    +favouriteCount: 107
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1702185373 {#2119
      date: 2023-12-10 06:16:13.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2044 …}
    +votes: Doctrine\ORM\PersistentCollection {#2127 …}
    +reports: Doctrine\ORM\PersistentCollection {#2043 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2215 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2198 …}
    +badges: Doctrine\ORM\PersistentCollection {#2227 …}
    +children: [
      App\Entity\EntryComment {#1564}
    ]
    -id: 21188
    -titleTs: "'arriv':6 'backup':4 'camera':3 'drive':2 'proton':1"
    -bodyTs: "'abl':17 'away':20 'backup':29 'featur':8 'final':15 'googl':22 'key':7 'mobil':27 'move':19 'one':4 'onedr':25 'photo':23,28 've':10 'wait':12"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1702132508
    +visibility: "visible             "
    +apId: "https://lemmy.ca/post/10899393"
    +editedAt: null
    +createdAt: DateTimeImmutable @1702046108 {#2052
      date: 2023-12-08 15:35:08.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
  +image: null
  +parent: null
  +root: null
  +body: "Thanks for sharing, I was not aware of it, and it worked like a charm."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 3
  +score: 0
  +lastActive: DateTime @1702054271 {#1584
    date: 2023-12-08 17:51:11.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@OminousOrange@lemmy.ca"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1567 …}
  +nested: Doctrine\ORM\PersistentCollection {#1563 …}
  +votes: Doctrine\ORM\PersistentCollection {#1565 …}
  +reports: Doctrine\ORM\PersistentCollection {#1558 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1557 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1621 …}
  -id: 211123
  -bodyTs: "'awar':7 'charm':15 'like':13 'share':3 'thank':1 'work':12"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5899794"
  +editedAt: null
  +createdAt: DateTimeImmutable @1702054271 {#1548
    date: 2023-12-08 17:51:11.0 +01:00
  }
  +"title": 211123
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
36 DENIED moderate 
App\Entity\EntryComment {#1564
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1559
    +user: Proxies\__CG__\App\Entity\User {#2073 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2163 …}
    +slug: "Proton-Drive-Camera-Backup-has-Arrived"
    +title: "Proton Drive Camera Backup has Arrived!"
    +url: "https://proton.me/support/enable-photo-backup"
    +body: "This has been one of the key features I’ve been waiting for to finally be able to move away from Google Photos and OneDrive for mobile photos backup."
    +type: "link"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 9
    +favouriteCount: 107
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1702185373 {#2119
      date: 2023-12-10 06:16:13.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2044 …}
    +votes: Doctrine\ORM\PersistentCollection {#2127 …}
    +reports: Doctrine\ORM\PersistentCollection {#2043 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2215 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2198 …}
    +badges: Doctrine\ORM\PersistentCollection {#2227 …}
    +children: [
      App\Entity\EntryComment {#1564}
    ]
    -id: 21188
    -titleTs: "'arriv':6 'backup':4 'camera':3 'drive':2 'proton':1"
    -bodyTs: "'abl':17 'away':20 'backup':29 'featur':8 'final':15 'googl':22 'key':7 'mobil':27 'move':19 'one':4 'onedr':25 'photo':23,28 've':10 'wait':12"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1702132508
    +visibility: "visible             "
    +apId: "https://lemmy.ca/post/10899393"
    +editedAt: null
    +createdAt: DateTimeImmutable @1702046108 {#2052
      date: 2023-12-08 15:35:08.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1525 …}
  +image: null
  +parent: null
  +root: null
  +body: "Thanks for sharing, I was not aware of it, and it worked like a charm."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 3
  +score: 0
  +lastActive: DateTime @1702054271 {#1584
    date: 2023-12-08 17:51:11.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@OminousOrange@lemmy.ca"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1567 …}
  +nested: Doctrine\ORM\PersistentCollection {#1563 …}
  +votes: Doctrine\ORM\PersistentCollection {#1565 …}
  +reports: Doctrine\ORM\PersistentCollection {#1558 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1557 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1621 …}
  -id: 211123
  -bodyTs: "'awar':7 'charm':15 'like':13 'share':3 'thank':1 'work':12"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5899794"
  +editedAt: null
  +createdAt: DateTimeImmutable @1702054271 {#1548
    date: 2023-12-08 17:51:11.0 +01:00
  }
  +"title": 211123
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
37 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
38 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1578
  +user: Proxies\__CG__\App\Entity\User {#2057 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: Proxies\__CG__\App\Entity\Image {#2232 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2228 …}
  +slug: "7-Ways-to-Tweak-Sudo-Command-in-Linux"
  +title: "7 Ways to Tweak Sudo Command in Linux"
  +url: "https://itsfoss.com/sudo-tips/"
  +body: null
  +type: "link"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 20
  +favouriteCount: 61
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1701904582 {#2214
    date: 2023-12-07 00:16:22.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2252 …}
  +votes: Doctrine\ORM\PersistentCollection {#2189 …}
  +reports: Doctrine\ORM\PersistentCollection {#2311 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2293 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2309 …}
  +badges: Doctrine\ORM\PersistentCollection {#2302 …}
  +children: [
    App\Entity\EntryComment {#1595
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1578 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1654 …}
      +body: """
        If you containerize, the application (malware) will run under the user configured in the image, unless you override it, and in a separate mount namespace, unless you change that, which makes the “alias sudo” trick extremely unlikely.\n
        \n
        Even running under a separate user anyway prevents almost fully the attack you mention, unless the separate user has root privileges or the DAC_OVERRIDE capability is assigned to the binary (assigning it requires CAP_SYS_ADMIN).\n
        \n
        In short, the attack you mention is a common persistence and privilege escalation vector, which is relatively easy to detect (watch for changes to shell profiles), although preventing it requires some care. I just want to point out that in single-user machines (e.g. personal computers) escalating to root is anyway fairly unnecessary, given that all the juicy stuff (ssh keys, data, etc.) is anyway probably running under/owned by that user.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1701900436 {#1430
        date: 2023-12-06 23:07:16.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@petsoi@discuss.tchncs.de"
        "@Pantherina@feddit.de"
        "@digdilem@lemmy.ml"
        "@IAm_A_Complete_Idiot@sh.itjust.works"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1679 …}
      +nested: Doctrine\ORM\PersistentCollection {#1668 …}
      +votes: Doctrine\ORM\PersistentCollection {#1666 …}
      +reports: Doctrine\ORM\PersistentCollection {#1669 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1549 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1573 …}
      -id: 204267
      -bodyTs: "'admin':74 'alia':33 'almost':46 'although':101 'anyway':44,126,140 'applic':5 'assign':65,69 'attack':49,78 'binari':68 'cap':72 'capabl':63 'care':106 'chang':28,97 'common':83 'comput':121 'configur':12 'container':3 'dac':61 'data':137 'detect':94 'e.g':119 'easi':92 'escal':87,122 'etc':138 'even':38 'extrem':36 'fair':127 'fulli':47 'given':129 'imag':15 'juici':133 'key':136 'machin':118 'make':31 'malwar':6 'mention':51,80 'mount':24 'namespac':25 'overrid':18,62 'persist':84 'person':120 'point':111 'prevent':45,102 'privileg':58,86 'probabl':141 'profil':100 'relat':91 'requir':71,104 'root':57,124 'run':8,39,142 'separ':23,42,54 'shell':99 'short':76 'singl':116 'single-us':115 'ssh':135 'stuff':134 'sudo':34 'sys':73 'trick':35 'under/owned':143 'unless':16,26,52 'unlik':37 'unnecessari':128 'user':11,43,55,117,146 'vector':88 'want':109 'watch':95"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/5856485"
      +editedAt: null
      +createdAt: DateTimeImmutable @1701900436 {#1429
        date: 2023-12-06 23:07:16.0 +01:00
      }
      +"title": 204267
    }
  ]
  -id: 20409
  -titleTs: "'7':1 'command':6 'linux':8 'sudo':5 'tweak':4 'way':2"
  -bodyTs: null
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1701888483
  +visibility: "visible             "
  +apId: "https://discuss.tchncs.de/post/7337171"
  +editedAt: null
  +createdAt: DateTimeImmutable @1701802083 {#2162
    date: 2023-12-05 19:48:03.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
39 DENIED edit 
Proxies\__CG__\App\Entity\Entry {#1578
  +user: Proxies\__CG__\App\Entity\User {#2057 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: Proxies\__CG__\App\Entity\Image {#2232 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2228 …}
  +slug: "7-Ways-to-Tweak-Sudo-Command-in-Linux"
  +title: "7 Ways to Tweak Sudo Command in Linux"
  +url: "https://itsfoss.com/sudo-tips/"
  +body: null
  +type: "link"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 20
  +favouriteCount: 61
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1701904582 {#2214
    date: 2023-12-07 00:16:22.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2252 …}
  +votes: Doctrine\ORM\PersistentCollection {#2189 …}
  +reports: Doctrine\ORM\PersistentCollection {#2311 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2293 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2309 …}
  +badges: Doctrine\ORM\PersistentCollection {#2302 …}
  +children: [
    App\Entity\EntryComment {#1595
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1578 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1654 …}
      +body: """
        If you containerize, the application (malware) will run under the user configured in the image, unless you override it, and in a separate mount namespace, unless you change that, which makes the “alias sudo” trick extremely unlikely.\n
        \n
        Even running under a separate user anyway prevents almost fully the attack you mention, unless the separate user has root privileges or the DAC_OVERRIDE capability is assigned to the binary (assigning it requires CAP_SYS_ADMIN).\n
        \n
        In short, the attack you mention is a common persistence and privilege escalation vector, which is relatively easy to detect (watch for changes to shell profiles), although preventing it requires some care. I just want to point out that in single-user machines (e.g. personal computers) escalating to root is anyway fairly unnecessary, given that all the juicy stuff (ssh keys, data, etc.) is anyway probably running under/owned by that user.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1701900436 {#1430
        date: 2023-12-06 23:07:16.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@petsoi@discuss.tchncs.de"
        "@Pantherina@feddit.de"
        "@digdilem@lemmy.ml"
        "@IAm_A_Complete_Idiot@sh.itjust.works"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1679 …}
      +nested: Doctrine\ORM\PersistentCollection {#1668 …}
      +votes: Doctrine\ORM\PersistentCollection {#1666 …}
      +reports: Doctrine\ORM\PersistentCollection {#1669 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1549 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1573 …}
      -id: 204267
      -bodyTs: "'admin':74 'alia':33 'almost':46 'although':101 'anyway':44,126,140 'applic':5 'assign':65,69 'attack':49,78 'binari':68 'cap':72 'capabl':63 'care':106 'chang':28,97 'common':83 'comput':121 'configur':12 'container':3 'dac':61 'data':137 'detect':94 'e.g':119 'easi':92 'escal':87,122 'etc':138 'even':38 'extrem':36 'fair':127 'fulli':47 'given':129 'imag':15 'juici':133 'key':136 'machin':118 'make':31 'malwar':6 'mention':51,80 'mount':24 'namespac':25 'overrid':18,62 'persist':84 'person':120 'point':111 'prevent':45,102 'privileg':58,86 'probabl':141 'profil':100 'relat':91 'requir':71,104 'root':57,124 'run':8,39,142 'separ':23,42,54 'shell':99 'short':76 'singl':116 'single-us':115 'ssh':135 'stuff':134 'sudo':34 'sys':73 'trick':35 'under/owned':143 'unless':16,26,52 'unlik':37 'unnecessari':128 'user':11,43,55,117,146 'vector':88 'want':109 'watch':95"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/5856485"
      +editedAt: null
      +createdAt: DateTimeImmutable @1701900436 {#1429
        date: 2023-12-06 23:07:16.0 +01:00
      }
      +"title": 204267
    }
  ]
  -id: 20409
  -titleTs: "'7':1 'command':6 'linux':8 'sudo':5 'tweak':4 'way':2"
  -bodyTs: null
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1701888483
  +visibility: "visible             "
  +apId: "https://discuss.tchncs.de/post/7337171"
  +editedAt: null
  +createdAt: DateTimeImmutable @1701802083 {#2162
    date: 2023-12-05 19:48:03.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
40 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1578
  +user: Proxies\__CG__\App\Entity\User {#2057 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: Proxies\__CG__\App\Entity\Image {#2232 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2228 …}
  +slug: "7-Ways-to-Tweak-Sudo-Command-in-Linux"
  +title: "7 Ways to Tweak Sudo Command in Linux"
  +url: "https://itsfoss.com/sudo-tips/"
  +body: null
  +type: "link"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 20
  +favouriteCount: 61
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1701904582 {#2214
    date: 2023-12-07 00:16:22.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2252 …}
  +votes: Doctrine\ORM\PersistentCollection {#2189 …}
  +reports: Doctrine\ORM\PersistentCollection {#2311 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2293 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2309 …}
  +badges: Doctrine\ORM\PersistentCollection {#2302 …}
  +children: [
    App\Entity\EntryComment {#1595
      +user: App\Entity\User {#261 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1578 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1654 …}
      +body: """
        If you containerize, the application (malware) will run under the user configured in the image, unless you override it, and in a separate mount namespace, unless you change that, which makes the “alias sudo” trick extremely unlikely.\n
        \n
        Even running under a separate user anyway prevents almost fully the attack you mention, unless the separate user has root privileges or the DAC_OVERRIDE capability is assigned to the binary (assigning it requires CAP_SYS_ADMIN).\n
        \n
        In short, the attack you mention is a common persistence and privilege escalation vector, which is relatively easy to detect (watch for changes to shell profiles), although preventing it requires some care. I just want to point out that in single-user machines (e.g. personal computers) escalating to root is anyway fairly unnecessary, given that all the juicy stuff (ssh keys, data, etc.) is anyway probably running under/owned by that user.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1701900436 {#1430
        date: 2023-12-06 23:07:16.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@petsoi@discuss.tchncs.de"
        "@Pantherina@feddit.de"
        "@digdilem@lemmy.ml"
        "@IAm_A_Complete_Idiot@sh.itjust.works"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1679 …}
      +nested: Doctrine\ORM\PersistentCollection {#1668 …}
      +votes: Doctrine\ORM\PersistentCollection {#1666 …}
      +reports: Doctrine\ORM\PersistentCollection {#1669 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1549 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1573 …}
      -id: 204267
      -bodyTs: "'admin':74 'alia':33 'almost':46 'although':101 'anyway':44,126,140 'applic':5 'assign':65,69 'attack':49,78 'binari':68 'cap':72 'capabl':63 'care':106 'chang':28,97 'common':83 'comput':121 'configur':12 'container':3 'dac':61 'data':137 'detect':94 'e.g':119 'easi':92 'escal':87,122 'etc':138 'even':38 'extrem':36 'fair':127 'fulli':47 'given':129 'imag':15 'juici':133 'key':136 'machin':118 'make':31 'malwar':6 'mention':51,80 'mount':24 'namespac':25 'overrid':18,62 'persist':84 'person':120 'point':111 'prevent':45,102 'privileg':58,86 'probabl':141 'profil':100 'relat':91 'requir':71,104 'root':57,124 'run':8,39,142 'separ':23,42,54 'shell':99 'short':76 'singl':116 'single-us':115 'ssh':135 'stuff':134 'sudo':34 'sys':73 'trick':35 'under/owned':143 'unless':16,26,52 'unlik':37 'unnecessari':128 'user':11,43,55,117,146 'vector':88 'want':109 'watch':95"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/5856485"
      +editedAt: null
      +createdAt: DateTimeImmutable @1701900436 {#1429
        date: 2023-12-06 23:07:16.0 +01:00
      }
      +"title": 204267
    }
  ]
  -id: 20409
  -titleTs: "'7':1 'command':6 'linux':8 'sudo':5 'tweak':4 'way':2"
  -bodyTs: null
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1701888483
  +visibility: "visible             "
  +apId: "https://discuss.tchncs.de/post/7337171"
  +editedAt: null
  +createdAt: DateTimeImmutable @1701802083 {#2162
    date: 2023-12-05 19:48:03.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
41 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
42 DENIED moderate 
App\Entity\EntryComment {#1595
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1578
    +user: Proxies\__CG__\App\Entity\User {#2057 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: Proxies\__CG__\App\Entity\Image {#2232 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2228 …}
    +slug: "7-Ways-to-Tweak-Sudo-Command-in-Linux"
    +title: "7 Ways to Tweak Sudo Command in Linux"
    +url: "https://itsfoss.com/sudo-tips/"
    +body: null
    +type: "link"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 20
    +favouriteCount: 61
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1701904582 {#2214
      date: 2023-12-07 00:16:22.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2252 …}
    +votes: Doctrine\ORM\PersistentCollection {#2189 …}
    +reports: Doctrine\ORM\PersistentCollection {#2311 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2293 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2309 …}
    +badges: Doctrine\ORM\PersistentCollection {#2302 …}
    +children: [
      App\Entity\EntryComment {#1595}
    ]
    -id: 20409
    -titleTs: "'7':1 'command':6 'linux':8 'sudo':5 'tweak':4 'way':2"
    -bodyTs: null
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1701888483
    +visibility: "visible             "
    +apId: "https://discuss.tchncs.de/post/7337171"
    +editedAt: null
    +createdAt: DateTimeImmutable @1701802083 {#2162
      date: 2023-12-05 19:48:03.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1654 …}
  +body: """
    If you containerize, the application (malware) will run under the user configured in the image, unless you override it, and in a separate mount namespace, unless you change that, which makes the “alias sudo” trick extremely unlikely.\n
    \n
    Even running under a separate user anyway prevents almost fully the attack you mention, unless the separate user has root privileges or the DAC_OVERRIDE capability is assigned to the binary (assigning it requires CAP_SYS_ADMIN).\n
    \n
    In short, the attack you mention is a common persistence and privilege escalation vector, which is relatively easy to detect (watch for changes to shell profiles), although preventing it requires some care. I just want to point out that in single-user machines (e.g. personal computers) escalating to root is anyway fairly unnecessary, given that all the juicy stuff (ssh keys, data, etc.) is anyway probably running under/owned by that user.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1701900436 {#1430
    date: 2023-12-06 23:07:16.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@petsoi@discuss.tchncs.de"
    "@Pantherina@feddit.de"
    "@digdilem@lemmy.ml"
    "@IAm_A_Complete_Idiot@sh.itjust.works"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1679 …}
  +nested: Doctrine\ORM\PersistentCollection {#1668 …}
  +votes: Doctrine\ORM\PersistentCollection {#1666 …}
  +reports: Doctrine\ORM\PersistentCollection {#1669 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1549 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1573 …}
  -id: 204267
  -bodyTs: "'admin':74 'alia':33 'almost':46 'although':101 'anyway':44,126,140 'applic':5 'assign':65,69 'attack':49,78 'binari':68 'cap':72 'capabl':63 'care':106 'chang':28,97 'common':83 'comput':121 'configur':12 'container':3 'dac':61 'data':137 'detect':94 'e.g':119 'easi':92 'escal':87,122 'etc':138 'even':38 'extrem':36 'fair':127 'fulli':47 'given':129 'imag':15 'juici':133 'key':136 'machin':118 'make':31 'malwar':6 'mention':51,80 'mount':24 'namespac':25 'overrid':18,62 'persist':84 'person':120 'point':111 'prevent':45,102 'privileg':58,86 'probabl':141 'profil':100 'relat':91 'requir':71,104 'root':57,124 'run':8,39,142 'separ':23,42,54 'shell':99 'short':76 'singl':116 'single-us':115 'ssh':135 'stuff':134 'sudo':34 'sys':73 'trick':35 'under/owned':143 'unless':16,26,52 'unlik':37 'unnecessari':128 'user':11,43,55,117,146 'vector':88 'want':109 'watch':95"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5856485"
  +editedAt: null
  +createdAt: DateTimeImmutable @1701900436 {#1429
    date: 2023-12-06 23:07:16.0 +01:00
  }
  +"title": 204267
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
43 DENIED edit 
App\Entity\EntryComment {#1595
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1578
    +user: Proxies\__CG__\App\Entity\User {#2057 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: Proxies\__CG__\App\Entity\Image {#2232 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2228 …}
    +slug: "7-Ways-to-Tweak-Sudo-Command-in-Linux"
    +title: "7 Ways to Tweak Sudo Command in Linux"
    +url: "https://itsfoss.com/sudo-tips/"
    +body: null
    +type: "link"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 20
    +favouriteCount: 61
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1701904582 {#2214
      date: 2023-12-07 00:16:22.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2252 …}
    +votes: Doctrine\ORM\PersistentCollection {#2189 …}
    +reports: Doctrine\ORM\PersistentCollection {#2311 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2293 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2309 …}
    +badges: Doctrine\ORM\PersistentCollection {#2302 …}
    +children: [
      App\Entity\EntryComment {#1595}
    ]
    -id: 20409
    -titleTs: "'7':1 'command':6 'linux':8 'sudo':5 'tweak':4 'way':2"
    -bodyTs: null
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1701888483
    +visibility: "visible             "
    +apId: "https://discuss.tchncs.de/post/7337171"
    +editedAt: null
    +createdAt: DateTimeImmutable @1701802083 {#2162
      date: 2023-12-05 19:48:03.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1654 …}
  +body: """
    If you containerize, the application (malware) will run under the user configured in the image, unless you override it, and in a separate mount namespace, unless you change that, which makes the “alias sudo” trick extremely unlikely.\n
    \n
    Even running under a separate user anyway prevents almost fully the attack you mention, unless the separate user has root privileges or the DAC_OVERRIDE capability is assigned to the binary (assigning it requires CAP_SYS_ADMIN).\n
    \n
    In short, the attack you mention is a common persistence and privilege escalation vector, which is relatively easy to detect (watch for changes to shell profiles), although preventing it requires some care. I just want to point out that in single-user machines (e.g. personal computers) escalating to root is anyway fairly unnecessary, given that all the juicy stuff (ssh keys, data, etc.) is anyway probably running under/owned by that user.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1701900436 {#1430
    date: 2023-12-06 23:07:16.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@petsoi@discuss.tchncs.de"
    "@Pantherina@feddit.de"
    "@digdilem@lemmy.ml"
    "@IAm_A_Complete_Idiot@sh.itjust.works"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1679 …}
  +nested: Doctrine\ORM\PersistentCollection {#1668 …}
  +votes: Doctrine\ORM\PersistentCollection {#1666 …}
  +reports: Doctrine\ORM\PersistentCollection {#1669 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1549 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1573 …}
  -id: 204267
  -bodyTs: "'admin':74 'alia':33 'almost':46 'although':101 'anyway':44,126,140 'applic':5 'assign':65,69 'attack':49,78 'binari':68 'cap':72 'capabl':63 'care':106 'chang':28,97 'common':83 'comput':121 'configur':12 'container':3 'dac':61 'data':137 'detect':94 'e.g':119 'easi':92 'escal':87,122 'etc':138 'even':38 'extrem':36 'fair':127 'fulli':47 'given':129 'imag':15 'juici':133 'key':136 'machin':118 'make':31 'malwar':6 'mention':51,80 'mount':24 'namespac':25 'overrid':18,62 'persist':84 'person':120 'point':111 'prevent':45,102 'privileg':58,86 'probabl':141 'profil':100 'relat':91 'requir':71,104 'root':57,124 'run':8,39,142 'separ':23,42,54 'shell':99 'short':76 'singl':116 'single-us':115 'ssh':135 'stuff':134 'sudo':34 'sys':73 'trick':35 'under/owned':143 'unless':16,26,52 'unlik':37 'unnecessari':128 'user':11,43,55,117,146 'vector':88 'want':109 'watch':95"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5856485"
  +editedAt: null
  +createdAt: DateTimeImmutable @1701900436 {#1429
    date: 2023-12-06 23:07:16.0 +01:00
  }
  +"title": 204267
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
44 DENIED moderate 
App\Entity\EntryComment {#1595
  +user: App\Entity\User {#261 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1578
    +user: Proxies\__CG__\App\Entity\User {#2057 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
    +image: Proxies\__CG__\App\Entity\Image {#2232 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2228 …}
    +slug: "7-Ways-to-Tweak-Sudo-Command-in-Linux"
    +title: "7 Ways to Tweak Sudo Command in Linux"
    +url: "https://itsfoss.com/sudo-tips/"
    +body: null
    +type: "link"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 20
    +favouriteCount: 61
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1701904582 {#2214
      date: 2023-12-07 00:16:22.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2252 …}
    +votes: Doctrine\ORM\PersistentCollection {#2189 …}
    +reports: Doctrine\ORM\PersistentCollection {#2311 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2293 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2309 …}
    +badges: Doctrine\ORM\PersistentCollection {#2302 …}
    +children: [
      App\Entity\EntryComment {#1595}
    ]
    -id: 20409
    -titleTs: "'7':1 'command':6 'linux':8 'sudo':5 'tweak':4 'way':2"
    -bodyTs: null
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1701888483
    +visibility: "visible             "
    +apId: "https://discuss.tchncs.de/post/7337171"
    +editedAt: null
    +createdAt: DateTimeImmutable @1701802083 {#2162
      date: 2023-12-05 19:48:03.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1575 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1654 …}
  +body: """
    If you containerize, the application (malware) will run under the user configured in the image, unless you override it, and in a separate mount namespace, unless you change that, which makes the “alias sudo” trick extremely unlikely.\n
    \n
    Even running under a separate user anyway prevents almost fully the attack you mention, unless the separate user has root privileges or the DAC_OVERRIDE capability is assigned to the binary (assigning it requires CAP_SYS_ADMIN).\n
    \n
    In short, the attack you mention is a common persistence and privilege escalation vector, which is relatively easy to detect (watch for changes to shell profiles), although preventing it requires some care. I just want to point out that in single-user machines (e.g. personal computers) escalating to root is anyway fairly unnecessary, given that all the juicy stuff (ssh keys, data, etc.) is anyway probably running under/owned by that user.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1701900436 {#1430
    date: 2023-12-06 23:07:16.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@petsoi@discuss.tchncs.de"
    "@Pantherina@feddit.de"
    "@digdilem@lemmy.ml"
    "@IAm_A_Complete_Idiot@sh.itjust.works"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1679 …}
  +nested: Doctrine\ORM\PersistentCollection {#1668 …}
  +votes: Doctrine\ORM\PersistentCollection {#1666 …}
  +reports: Doctrine\ORM\PersistentCollection {#1669 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1549 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1573 …}
  -id: 204267
  -bodyTs: "'admin':74 'alia':33 'almost':46 'although':101 'anyway':44,126,140 'applic':5 'assign':65,69 'attack':49,78 'binari':68 'cap':72 'capabl':63 'care':106 'chang':28,97 'common':83 'comput':121 'configur':12 'container':3 'dac':61 'data':137 'detect':94 'e.g':119 'easi':92 'escal':87,122 'etc':138 'even':38 'extrem':36 'fair':127 'fulli':47 'given':129 'imag':15 'juici':133 'key':136 'machin':118 'make':31 'malwar':6 'mention':51,80 'mount':24 'namespac':25 'overrid':18,62 'persist':84 'person':120 'point':111 'prevent':45,102 'privileg':58,86 'probabl':141 'profil':100 'relat':91 'requir':71,104 'root':57,124 'run':8,39,142 'separ':23,42,54 'shell':99 'short':76 'singl':116 'single-us':115 'ssh':135 'stuff':134 'sudo':34 'sys':73 'trick':35 'under/owned':143 'unless':16,26,52 'unlik':37 'unnecessari':128 'user':11,43,55,117,146 'vector':88 'want':109 'watch':95"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5856485"
  +editedAt: null
  +createdAt: DateTimeImmutable @1701900436 {#1429
    date: 2023-12-06 23:07:16.0 +01:00
  }
  +"title": 204267
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
45 DENIED ROLE_ADMIN 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
46 DENIED ROLE_MODERATOR 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details