3 ms·
Don't you need root access to even start the container? I think that's there is a disconnect here. There is a difference between running a container as root and
by mbreese 11y ago
Don't you need root access to even start the container? I think that's there is a disconnect here. There is a difference between running a container as root and the process w/in the container running as root.
Sure, you don't need to have the process running as root in the container, but you need to have root-equivalent access to start the container. For a (large) subset of use-cases, this just isn't an option.
I should be able to allow any given user of a system the ability to start a docker container and be confident that they won't be able to break the host system. Until this is the case, you don't have security in Docker.
- davexunit 11y agoThe key is user namespaces. Unprivileged users can create containers easily via user namespaces. Once the user creates a user namespace, they have root in that namespace and are free to unshare the rest of the namespaces. This is how I wrote 'guix environment --container'[0], a tool for creating isolated development environments using the GNU Guix package manager. The big caveat is that unprivileged users do not setuid/setgid capability, so the number of uids/gids in the container is limited to 1, but I believe that even this is being dealt with in Linux now. [0] https://gnu.org/software/guix/manual/html_node/Invoking-guix-environment.html#Invoking-guix-environment https://gnu.org/software/guix/manual/html_node/Invoking-guix...
- ewindisch 11y agoYou also need to be root to manage your init process and in production, this is how Docker is treated. That said, I've seen work being done to add RBAC, given there are a set of users that desire this.