2 ms·
not the same thing. Containerization prevents devUser from accessing your machine root with its root. By containerizing, if devUser tries to sudo or su and gets
by reactordev 3mo ago
not the same thing. Containerization prevents devUser from accessing your machine root with its root. By containerizing, if devUser tries to sudo or su and gets a root, it will only be their root and not your root. Read up on cgroups.
- grosswait 3mo agoWhy would you allow devUser sudo?
- reactordev 3mo agonormally you wouldn't but there are some instances where a script or something requires sudo in which case you would need to namespace the cgroup and do a little more work to prevent escaping the sandbox. I can think of a few cases where sudo is required for cgroups/containers from the sandbox side so it can install services and things but ideally you would isolate everything to the devUser UID or GID.
- progval 3mo agoSuccessful sudo from a cgroup still makes you root on the machine. What you want for this is user namespaces, not (just) cgroups.
- reactordev 3mo agoyes, you would setup namespace and unshare it once mounted to isolate the sandbox so root only sees the sandbox / and not your /