10 ms·

Subuser turns Docker containers into normal Linux programs, limiting privileges

224 points by bpierre 11y ago

ilovefood 11y ago
Awesome! Now that I know this I can finally get to learn docker. The functionality provided by this tool is exactly what I was doing with several shitty Python scripts. Thanks mate!
- timthelion 11y ago
  I hope you find it useful. Please file a bug report if you have any problems!
jdoliner 11y ago
Very cool stuff. How compatible is this with docker-machine?
- Gys 11y ago
  Only for Linux: http://subuser.org/installation.html http://subuser.org/installation.html
  - alexlarsson 11y ago
    From that page: Warning: Being a member of the docker group is equivalent to having root access. Not a great way to limit privileges.
    - Filligree 11y ago
      The user using this has to be in that group, the programs being run do not. For a single-user machine, it may be okay. But I don't trust Docker's security very much.
      - raesene4 11y ago
        any particular reasons you don't trust Docker security?
        cyphar 11y ago
        The daemon has had many security issues. They also only recently grew support for ACLs (which are only available as plugins), so any user that can write to the Docker socket is essentially equivalent to root.
    - txutxu 11y ago
      I'm not a docker user, but I think on binaries I can always use still capabilities, to limit what they can do. I suppose most of them will be needed in this case, and it's still a concern. Just did want to remember to people about linux capabilities after read your comment: man -k cap | grep capabilities
- timthelion 11y ago
  It works with Docker. If you write a Dockerfile for a program, and create a permissions.json file, then your program will work with subuser. Subuser is a "very thin layer" that makes it easier to use Docker for desktop apps.
anc84 11y ago
I was always taught that Docker is not suitable for securely separating stuff, just for compartmentalisation. Something about running as root iirc?
- lojack 11y ago
  > Something about running as root iirc? The daemon runs as root, so your containers are only as secure as the daemon itself.
  - DannoHung 11y ago
    Nn, misread
  - cyphar 11y ago
    > > Something about running as root iirc? > The daemon runs as root, so your containers are only as secure as the daemon itself. This is not correct. The daemon only starts and monitors processes in this case. You can start a process as a different user. You can also use user namespaces to make "root in the container" not root on the host.
- roddux 11y ago
  You may be thinking about this issue: http://reventlov.com/advisories/using-the-docker-command-to-root-the-host http://reventlov.com/advisories/using-the-docker-command-to-... -- which incidentally is the first thing that came my mind, too. I'm not familiar with docker, but I'm unsure how subuser could work around this.
  - timthelion 11y ago
    Subuser doesn't work around this issue. As a USER you can become root using docker. However, that doesn't mean that your SUBusers can become root. And that's what you are trying to protect your system from. The "less trusted" code that is running in the subusers.
- raesene4 11y ago
  You may be thinking of the lack of user namespacing in Docker. Until v1.10 root in a container was the same user as root outside the container. This did not automatically lead to allow a contained user to breakout, but made it easier. In 1.10 user namespacing reduces this risk as the root user in a container can be remapped to another user account outside the container.
sandGorgon 11y ago
spectacular. now build a package repo, and give me "sbu-get install postgresql-9.5" which runs on both fedora and debian... and we are golden. I wonder how it compares with zeroinstall or nix
- antocv 11y ago
  I dont know if this is sarcasm or serious. Wasnt docker exactly meant for this purpose? docker run postgresql, oh wow.
- txutxu 11y ago
  Are you used you download a zip or tar.gz from upstream full of bundled dependencies?. I don't like that. As this is opensource and I get the source, I will download a full OS image or containerized binaries from third parties. Mmmm so spectacular. Apps running on chroots? We've that since the 90's, the relaxed security model of Xorg and it's client/server architecture was there already, and it was the reason to left windows 3.11/95 behind. But marketing campaigns are spectacular in effect in current money surrounded culture. Yes. Their network effect is spectacular. I would say so. Edited: missing question mark
  - timthelion 11y ago
    You realize, that I (the author of subuser) literally live off of money I beg off my parents. I get NO money from developing this. In terms of XOrg seecurity, I've worked on that: http://subuser.org/news/0.3.html#the-xpra-x11-bridge http://subuser.org/news/0.3.html#the-xpra-x11-bridge
    - txutxu 11y ago
      So you put your efforts on market trending topics. I can understand. Money surrounded culture does not exclude those that don't have the money, they are simply part of the game. This doesn't solve any problem I have currently or I cannot solve using tools I've already tested on my usage, but I hope you had fun writing the software and sharing it.
geggam 11y ago
but wouldnt it be easier to chroot / limit a program with a pre / post hook script and leverage existing package managers ?
- bencollier49 11y ago
  Of course not! The existing package managers don't have a cute logo and an unrealistic valuation.
  - timthelion 11y ago
    Unrealistic valuation? Is that what you call a couple hundred "stars" on github? If you ask me, stars aren't hardly worth squat. Perhaps a pull request every month or two... But I'm glad to see subuser getting some attention on HN now. Perhaps the PRs will start rolling in :D
    - deleted 11y ago
      [deleted]
    - bencollier49 11y ago
      I guess it would only be fair for Docker to cut you a couple of million, seeing as they're swimming in cash (apparently?)
      - timthelion 11y ago
        Unfortunately for me, I was asked to leave the Docker project after I got upset about SUSE wanting to add EULAs to Docker images: https://github.com/docker/docker/issues/7153 https://github.com/docker/docker/issues/7153 So I guess I don't get any millions. :(
- timthelion 11y ago
  Subuser DOES leverage existing package mangagers. All subuser "packages" are are scripts that call existing package managers: https://github.com/subuser-security/subuser-default-repository/blob/master/icedove/docker-image/SubuserImagefile https://github.com/subuser-security/subuser-default-reposito...
sscarduzio 11y ago
I still can't understand why can't this work in docker-machine in osx. Or can it?
- timthelion 11y ago
  There is not any really strong reason why it cannot work. I just haven't got an OSX machine, and now PRs have come in yet.
raesene4 11y ago
FWIW I think this is pretty cool. The main docker use-case is not desktop software, and some of it's choices are unlikely to suit that use-case well. So, good to see a project look at that aspect. I would quite like to be able to run all my apps which access untrusted services (e.g. all browsers) in a container which I can easily wipe/reset.
- timthelion 11y ago
  You are correct that Docker has some server centric designs. But luckly, the Docker project has split of runc (Docker's container runtime) and since images are just bare directory trees, there is really no claustrophobia about Docker being a bad choice...
api 11y ago
Like I said: Docker wants to be a linker and a binary format: http://adamierymenko.com/docker-not-even-a-linker/ http://adamierymenko.com/docker-not-even-a-linker/ If everything (mysql, pgsql, etc.) were a library you could achieve much of what it does with -static and privilege dropping on launch.
shiftoutbox 11y ago
Great so you made capisicum with docker . https://www.cl.cam.ac.uk/research/security/capsicum/ https://www.cl.cam.ac.uk/research/security/capsicum/ Docker docker docker docker
- timthelion 11y ago
  How does capisicum solve X11 insecurity? Subuser uses XPRA...
  - Sanddancer 11y ago
    The X11 part would be solved by xpra. Capsicum, however, feels like the better tool for the job of privilege isolation here. One of the more important things is that you're able to lock down access much more finely than you can with docker. You can use this to ensure that the locked down application can only communicate with xpra and put files only in certain folders, for example, without being able to see or interact with other processes. Your approach has the problem of needing the inherent insecurities of docker. Because everything within docker has to be managed either by root or someone within the docker group, you have a greater surface area exposed where if an malicious app is able to get hold of the docker socket file, it now owns your system. A capability-based security system, on the other hand, wouldn't be able to touch the docker socket, even if it was run as root.
heavenlyhash 11y ago
This is really cool! The first time I tried to run a GUI app in a container, I discovered there's a LOT of practical gaps between "okay I have containers" and "I want to run a graphical application". Subuser bridges those gaps nicely. My favorite part of reading the docs for subuser is how completely direct and honest they are about security of various features. E.g., if you enable some features of X bridging, you're accepting security risks, because that's how X works. (And if you don't need those features, don't enable them; it looks like subuser has it down to a one-word config flag, which is amazing.) By comparison, if you start out on your own... there's lots of brief tutorials on the internet about using xephyr, or xpra, or doing something really wildly unsafe like just plain mounting the X sockets in. But not only are all these things rough to get started on by yourself, the brief explanations thrown around are often not clear on the security implications. Subuser seems like a great way to do the right things... out of the box. And with excellent truth in packaging. I've accumulated a lot of scripts in my personal `~/bin` over the last couple years that do stuff like "mount cwd and interesting dir $x, make sure image with $prog is here or fetch it, now pass args and invoke $prog with $HOME=..." -- and while these have been really useful to me, they've been ad-hoc and almost impossible to usefully share with others. Subuser's format for making valuable configuration like this sharable is extremely interesting.
nyan4 11y ago
How is Docker + Subuser different than just using firejail?
- timthelion 11y ago
  firejail is security centered. It allows you to secure the apps you already have on your system. Zeroinstall is distribution centered. It allows you to easilly distribute software across distros. Subuser is like zeroinstall + firejail.
256TiB 11y ago
What I would very much like is a program that allows me to run a Windows program like Photoshop on Linux through something like Docker. I know I can run PS for instance with Wine and CS2, but due to professional needs I need CC .. Gimp won't cut it. This would free me up to great extend from Microsoft and Apple. I understand this is solely for Linux programs?
- mbreese 11y ago
  If you want to run a Windows program on a Linux machine, you'll have to run it through a full copy of Windows in a virtual machine. Docker isn't going to help you here...
- m12k 11y ago
  http://askubuntu.com/questions/530110/how-can-i-install-photoshop-cs6-on-ubuntu-14-04 http://askubuntu.com/questions/530110/how-can-i-install-phot...
  - heavenlyhash 11y ago
    So wine can do it? That's pretty sweet. It seems like it would make sense to combine this with subuser to make sure you keep a known-good version of wine and its configuration. I've known wine compatibility to drift unpleasantly from time to time, or accidentally lost obscure config changes I made once... (I have fond memories of a time when I could play Supreme Commander on linux in wine... but I've since lost that machine, and I haven't been able to reproduce the dang setup again since :( If subuser had existed back then, I'd probably have a snapshot and I'd be happily playing right now...)
    - zzzcpan 11y ago
      > So wine can do it? That's pretty sweet. Probably not. Technically, wine was able to run various versions of Photoshop for years. But it was never stable nor complete enough to use it professionally, with wacom tablets and such.

224 points by bpierre 11y ago

Awesome! Now that I know this I can finally get to learn docker. The functionality provided by this tool is exactly what I was doing with several shitty Python scripts. Thanks mate!

timthelion 11y ago
I hope you find it useful. Please file a bug report if you have any problems!

jdoliner 11y ago

Very cool stuff. How compatible is this with docker-machine?

Gys 11y ago
Only for Linux: http://subuser.org/installation.html http://subuser.org/installation.html
- alexlarsson 11y ago
  From that page: Warning: Being a member of the docker group is equivalent to having root access. Not a great way to limit privileges.
  - Filligree 11y ago
    The user using this has to be in that group, the programs being run do not. For a single-user machine, it may be okay. But I don't trust Docker's security very much.
    - raesene4 11y ago
      any particular reasons you don't trust Docker security?
      - cyphar 11y ago
        The daemon has had many security issues. They also only recently grew support for ACLs (which are only available as plugins), so any user that can write to the Docker socket is essentially equivalent to root.
  - txutxu 11y ago
    I'm not a docker user, but I think on binaries I can always use still capabilities, to limit what they can do. I suppose most of them will be needed in this case, and it's still a concern. Just did want to remember to people about linux capabilities after read your comment: man -k cap | grep capabilities
timthelion 11y ago
It works with Docker. If you write a Dockerfile for a program, and create a permissions.json file, then your program will work with subuser. Subuser is a "very thin layer" that makes it easier to use Docker for desktop apps.

anc84 11y ago

I was always taught that Docker is not suitable for securely separating stuff, just for compartmentalisation. Something about running as root iirc?

lojack 11y ago
> Something about running as root iirc? The daemon runs as root, so your containers are only as secure as the daemon itself.
- DannoHung 11y ago
  Nn, misread
- cyphar 11y ago
  > > Something about running as root iirc? > The daemon runs as root, so your containers are only as secure as the daemon itself. This is not correct. The daemon only starts and monitors processes in this case. You can start a process as a different user. You can also use user namespaces to make "root in the container" not root on the host.
roddux 11y ago
You may be thinking about this issue: http://reventlov.com/advisories/using-the-docker-command-to-root-the-host http://reventlov.com/advisories/using-the-docker-command-to-... -- which incidentally is the first thing that came my mind, too. I'm not familiar with docker, but I'm unsure how subuser could work around this.
- timthelion 11y ago
  Subuser doesn't work around this issue. As a USER you can become root using docker. However, that doesn't mean that your SUBusers can become root. And that's what you are trying to protect your system from. The "less trusted" code that is running in the subusers.
raesene4 11y ago
You may be thinking of the lack of user namespacing in Docker. Until v1.10 root in a container was the same user as root outside the container. This did not automatically lead to allow a contained user to breakout, but made it easier. In 1.10 user namespacing reduces this risk as the root user in a container can be remapped to another user account outside the container.

sandGorgon 11y ago

spectacular. now build a package repo, and give me "sbu-get install postgresql-9.5" which runs on both fedora and debian... and we are golden. I wonder how it compares with zeroinstall or nix

antocv 11y ago
I dont know if this is sarcasm or serious. Wasnt docker exactly meant for this purpose? docker run postgresql, oh wow.
txutxu 11y ago
Are you used you download a zip or tar.gz from upstream full of bundled dependencies?. I don't like that. As this is opensource and I get the source, I will download a full OS image or containerized binaries from third parties. Mmmm so spectacular. Apps running on chroots? We've that since the 90's, the relaxed security model of Xorg and it's client/server architecture was there already, and it was the reason to left windows 3.11/95 behind. But marketing campaigns are spectacular in effect in current money surrounded culture. Yes. Their network effect is spectacular. I would say so. Edited: missing question mark
- timthelion 11y ago
  You realize, that I (the author of subuser) literally live off of money I beg off my parents. I get NO money from developing this. In terms of XOrg seecurity, I've worked on that: http://subuser.org/news/0.3.html#the-xpra-x11-bridge http://subuser.org/news/0.3.html#the-xpra-x11-bridge
  - txutxu 11y ago
    So you put your efforts on market trending topics. I can understand. Money surrounded culture does not exclude those that don't have the money, they are simply part of the game. This doesn't solve any problem I have currently or I cannot solve using tools I've already tested on my usage, but I hope you had fun writing the software and sharing it.

geggam 11y ago

but wouldnt it be easier to chroot / limit a program with a pre / post hook script and leverage existing package managers ?

bencollier49 11y ago
Of course not! The existing package managers don't have a cute logo and an unrealistic valuation.
- timthelion 11y ago
  Unrealistic valuation? Is that what you call a couple hundred "stars" on github? If you ask me, stars aren't hardly worth squat. Perhaps a pull request every month or two... But I'm glad to see subuser getting some attention on HN now. Perhaps the PRs will start rolling in :D
  - deleted 11y ago
    [deleted]
  - bencollier49 11y ago
    I guess it would only be fair for Docker to cut you a couple of million, seeing as they're swimming in cash (apparently?)
    - timthelion 11y ago
      Unfortunately for me, I was asked to leave the Docker project after I got upset about SUSE wanting to add EULAs to Docker images: https://github.com/docker/docker/issues/7153 https://github.com/docker/docker/issues/7153 So I guess I don't get any millions. :(
timthelion 11y ago
Subuser DOES leverage existing package mangagers. All subuser "packages" are are scripts that call existing package managers: https://github.com/subuser-security/subuser-default-repository/blob/master/icedove/docker-image/SubuserImagefile https://github.com/subuser-security/subuser-default-reposito...

sscarduzio 11y ago

I still can't understand why can't this work in docker-machine in osx. Or can it?

timthelion 11y ago
There is not any really strong reason why it cannot work. I just haven't got an OSX machine, and now PRs have come in yet.

raesene4 11y ago

FWIW I think this is pretty cool. The main docker use-case is not desktop software, and some of it's choices are unlikely to suit that use-case well. So, good to see a project look at that aspect. I would quite like to be able to run all my apps which access untrusted services (e.g. all browsers) in a container which I can easily wipe/reset.

timthelion 11y ago
You are correct that Docker has some server centric designs. But luckly, the Docker project has split of runc (Docker's container runtime) and since images are just bare directory trees, there is really no claustrophobia about Docker being a bad choice...

api 11y ago

Like I said: Docker wants to be a linker and a binary format: http://adamierymenko.com/docker-not-even-a-linker/ http://adamierymenko.com/docker-not-even-a-linker/ If everything (mysql, pgsql, etc.) were a library you could achieve much of what it does with -static and privilege dropping on launch.

shiftoutbox 11y ago

Great so you made capisicum with docker . https://www.cl.cam.ac.uk/research/security/capsicum/ https://www.cl.cam.ac.uk/research/security/capsicum/ Docker docker docker docker

timthelion 11y ago
How does capisicum solve X11 insecurity? Subuser uses XPRA...
- Sanddancer 11y ago
  The X11 part would be solved by xpra. Capsicum, however, feels like the better tool for the job of privilege isolation here. One of the more important things is that you're able to lock down access much more finely than you can with docker. You can use this to ensure that the locked down application can only communicate with xpra and put files only in certain folders, for example, without being able to see or interact with other processes. Your approach has the problem of needing the inherent insecurities of docker. Because everything within docker has to be managed either by root or someone within the docker group, you have a greater surface area exposed where if an malicious app is able to get hold of the docker socket file, it now owns your system. A capability-based security system, on the other hand, wouldn't be able to touch the docker socket, even if it was run as root.

heavenlyhash 11y ago

This is really cool! The first time I tried to run a GUI app in a container, I discovered there's a LOT of practical gaps between "okay I have containers" and "I want to run a graphical application". Subuser bridges those gaps nicely. My favorite part of reading the docs for subuser is how completely direct and honest they are about security of various features. E.g., if you enable some features of X bridging, you're accepting security risks, because that's how X works. (And if you don't need those features, don't enable them; it looks like subuser has it down to a one-word config flag, which is amazing.) By comparison, if you start out on your own... there's lots of brief tutorials on the internet about using xephyr, or xpra, or doing something really wildly unsafe like just plain mounting the X sockets in. But not only are all these things rough to get started on by yourself, the brief explanations thrown around are often not clear on the security implications. Subuser seems like a great way to do the right things... out of the box. And with excellent truth in packaging. I've accumulated a lot of scripts in my personal `~/bin` over the last couple years that do stuff like "mount cwd and interesting dir $x, make sure image with $prog is here or fetch it, now pass args and invoke $prog with $HOME=..." -- and while these have been really useful to me, they've been ad-hoc and almost impossible to usefully share with others. Subuser's format for making valuable configuration like this sharable is extremely interesting.

nyan4 11y ago

How is Docker + Subuser different than just using firejail?

timthelion 11y ago
firejail is security centered. It allows you to secure the apps you already have on your system. Zeroinstall is distribution centered. It allows you to easilly distribute software across distros. Subuser is like zeroinstall + firejail.

256TiB 11y ago

What I would very much like is a program that allows me to run a Windows program like Photoshop on Linux through something like Docker. I know I can run PS for instance with Wine and CS2, but due to professional needs I need CC .. Gimp won't cut it. This would free me up to great extend from Microsoft and Apple. I understand this is solely for Linux programs?

mbreese 11y ago
If you want to run a Windows program on a Linux machine, you'll have to run it through a full copy of Windows in a virtual machine. Docker isn't going to help you here...
m12k 11y ago
http://askubuntu.com/questions/530110/how-can-i-install-photoshop-cs6-on-ubuntu-14-04 http://askubuntu.com/questions/530110/how-can-i-install-phot...
- heavenlyhash 11y ago
  So wine can do it? That's pretty sweet. It seems like it would make sense to combine this with subuser to make sure you keep a known-good version of wine and its configuration. I've known wine compatibility to drift unpleasantly from time to time, or accidentally lost obscure config changes I made once... (I have fond memories of a time when I could play Supreme Commander on linux in wine... but I've since lost that machine, and I haven't been able to reproduce the dang setup again since :( If subuser had existed back then, I'd probably have a snapshot and I'd be happily playing right now...)
  - zzzcpan 11y ago
    > So wine can do it? That's pretty sweet. Probably not. Technically, wine was able to run various versions of Photoshop for years. But it was never stable nor complete enough to use it professionally, with wacom tablets and such.