4 ms·

Eeehhh, I'm going to go out on a limb and say that Docker containers, as of 1.6, do reduce security. Without user namespaces, container root is system root, and

Eeehhh, I'm going to go out on a limb and say that Docker containers, as of 1.6, do reduce security. Without user namespaces, container root is system root, and the number of images that run as container root is incredibly high (where they might otherwise be running as system non-root). 1.7 should change this, as we'll finally get user namespaces, though I don't know how many people will end up using them; let's hope they're on by default, I guess.

justincormack 12y ago
But if you run stuff as root you already lost, container or not. Why are so many people running containers as root? Is it because they are running whole distros that expect that? User namespaces are going to be really complicated to work with not really convinced they are the panacea people expect. Not running as root is much easier!
- lclarkmichalek 12y ago
  Sure. I'm just saying that running stuff as root is the de-facto standard in the container world; it isn't outside of the docker ecosystem. Take, for example, the docker registry image[0]. Runs as root. In what world, other than the docker world, would that be considered acceptable? [0] https://github.com/docker/docker-registry/blob/0.9.1/Dockerfile https://github.com/docker/docker-registry/blob/0.9.1/Dockerf...
rubiquity 12y ago
By your logic that means all operating systems are insecure because users can run things as root. I've grown tired of hearing this argument against containers (not just Docker). It applies to security in general.
ewindisch 12y ago
The container root certainly has UID 0, but it has reduced system capabilities. The irony of user namespaces is that they provide additional capabilities, but give you a fake UID-0 while "actually" running as a higher UID. This distinction is important because it's why, in practice, Docker's current approach has proven to be more secure than user namespaces. User namespaces allow various operations that would be outright denied under a Docker container's very-real-but-very-limited root user. However, yes, user namespaces are coming to Docker. It's a highly desired feature and eventually userns will mature.
- lclarkmichalek 12y ago
  I'd be interested to see how the current approach has been proven to be more secure than userns, though I can well beleive it. I do agree that dropping capabilities is good, however, even with the reduced capabilities provided, the kernel is still a very large target, and so I would sleep a lot easier with userns active (in addition to capability (and mb even seccomp ;)) filtering) on all my containers. It just seems like such a free win (and I appreciate how that must sound to the people who are implementing it).

justincormack 12y ago

But if you run stuff as root you already lost, container or not. Why are so many people running containers as root? Is it because they are running whole distros that expect that? User namespaces are going to be really complicated to work with not really convinced they are the panacea people expect. Not running as root is much easier!

lclarkmichalek 12y ago
Sure. I'm just saying that running stuff as root is the de-facto standard in the container world; it isn't outside of the docker ecosystem. Take, for example, the docker registry image[0]. Runs as root. In what world, other than the docker world, would that be considered acceptable? [0] https://github.com/docker/docker-registry/blob/0.9.1/Dockerfile https://github.com/docker/docker-registry/blob/0.9.1/Dockerf...

rubiquity 12y ago

By your logic that means all operating systems are insecure because users can run things as root. I've grown tired of hearing this argument against containers (not just Docker). It applies to security in general.

ewindisch 12y ago

The container root certainly has UID 0, but it has reduced system capabilities. The irony of user namespaces is that they provide additional capabilities, but give you a fake UID-0 while "actually" running as a higher UID. This distinction is important because it's why, in practice, Docker's current approach has proven to be more secure than user namespaces. User namespaces allow various operations that would be outright denied under a Docker container's very-real-but-very-limited root user. However, yes, user namespaces are coming to Docker. It's a highly desired feature and eventually userns will mature.

lclarkmichalek 12y ago
I'd be interested to see how the current approach has been proven to be more secure than userns, though I can well beleive it. I do agree that dropping capabilities is good, however, even with the reduced capabilities provided, the kernel is still a very large target, and so I would sleep a lot easier with userns active (in addition to capability (and mb even seccomp ;)) filtering) on all my containers. It just seems like such a free win (and I appreciate how that must sound to the people who are implementing it).