Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing Services with Rootless Containers

blog.coderspirit.xyz

Post reply on HN
Print view View original

11–20 of 40 posts

Re: Securing Services with Rootless Containers

#11

Post by teravor »

ranger_danger wrote: post #3

Personally I still think this is not enough, and we really need full generalized (not AI-only) microvm support built into docker/podman, like yesterday. Currently it's difficult to even get a hold of a properly configured minimal kernel (or time-consuming to try to build one) and all the right command-line incantations to even start a one-off microvm using say, qemu, with all the proper storage/networking/etc. bits o…

this has already been done.

runsc (gvisor)

Kata Containers (virtualization)

both drop in replacements for runc (default OCI runtime)

there are others too. one based on libkrun : https://github.com/containers/crun/blob/main/krun.1.md

and these are just runc replacements.

with some minor scripting you can roll a CLI solution using any of gvisor, cloud-hypervisor, firecracker, muvm (libkrun).

Re: Securing Services with Rootless Containers

#12

Post by dagss »

ranger_danger wrote: post #3

Personally I still think this is not enough, and we really need full generalized (not AI-only) microvm support built into docker/podman, like yesterday. Currently it's difficult to even get a hold of a properly configured minimal kernel (or time-consuming to try to build one) and all the right command-line incantations to even start a one-off microvm using say, qemu, with all the proper storage/networking/etc. bits o…

BETA: I have been following https://github.com/superradcompany/microsandbox a bit, very simple to get started with at least.

Re: Securing Services with Rootless Containers

#13

Post by drnick1 »

kayson wrote: post #4

I'd still rather use docker. I don't mind that the daemon runs as root because there are some things that you need root for anyways! Like binding to privileged ports or setting up networks (use `internal: true` and the daemon will automatically set up iptables rules that limit traffic). I deploy docker compose files with ansible so everything comes with built in security defaults like rootless, dropped caps, no new p…

Rootless is definitely the way to go. You can forward ports manually on the host if you really need to use privileged ports. I generally expose my containers through a reverse proxy, running bare metal on the host, and that completely bypasses the privileged port issue.

Re: Securing Services with Rootless Containers

#14

Post by bityard »

zerof1l wrote: post #9
latchkey wrote: post #8

Earlier quoted context omitted.

just curious why you'd bind to a priv port inside of a container.

This whole privileged port thing is an outdated convention from the time when Linux ran on mainframes. Depending on your use case, it can be perfectly fine to lower it. I have set to `net.ipvX.ip_unprivileged_port_start = 80` on my server so that I can run rootless containers without extra privileges and have them bind to ports 80 and up.

Nits: It's a Unix convention (not just Linux), and Unix traditionally ran on minicomputers (not mainframes). Mainframes had their own specialized OSes, although some could run Unix in a partition or virtual machine.

Re: Securing Services with Rootless Containers

#15

Post by lugoues »

seemaze wrote: post #5

The '--userns=auto' argument is a useful isolation method in both rootless and rootful Podman containers. This allows rootful Podman to orchestrate privileged capabilities while running the container processes in an unprivileged namespace. See the discussion here: https://github.com/podman-container-tools/podman/discussions...

I've been doing this for a while now and it is by far much easier to work with and just as safe if configured properly. I think people just cargo cult thier way into wanting rootless containers for their long running services with no real look into if it's actually needed.

Rootless containers have their place, actual userspace workloads. Things like dev containers or normal users running containers but if one is creating users to run system level services then they are just adding extra steps imo.

Re: Securing Services with Rootless Containers

#17

Post by dboreham »

zerof1l wrote: post #9
latchkey wrote: post #8

Earlier quoted context omitted.

just curious why you'd bind to a priv port inside of a container.

This whole privileged port thing is an outdated convention from the time when Linux ran on mainframes. Depending on your use case, it can be perfectly fine to lower it. I have set to `net.ipvX.ip_unprivileged_port_start = 80` on my server so that I can run rootless containers without extra privileges and have them bind to ports 80 and up.

lol the before times when Linux ran on mainframes.

It does run on IBM 370 type mainframes, but that port was done years after it first ran on the 386, and isn't in any way relevant to low port numbers.

Re: Securing Services with Rootless Containers

#18

Post by dboreham »

ranger_danger wrote: post #3

Personally I still think this is not enough, and we really need full generalized (not AI-only) microvm support built into docker/podman, like yesterday. Currently it's difficult to even get a hold of a properly configured minimal kernel (or time-consuming to try to build one) and all the right command-line incantations to even start a one-off microvm using say, qemu, with all the proper storage/networking/etc. bits o…

Many such things have been built. Problem afaik is that the underlying hypervisor setup to support VMs isn't present, or isn't enabled by default, or is hard to figure out, on many machines. Plus you need nested virtualization when the thing you're using is a VM itself (also comes with possible pain). Docker runs because it has "ROAC" properties (Runs On Any Computer). That's not today true of VMs (of which micro-VMs, firecracker etc are a subset).

Re: Securing Services with Rootless Containers

#20

Post by LelouBil »

kayson wrote: post #4

I'd still rather use docker. I don't mind that the daemon runs as root because there are some things that you need root for anyways! Like binding to privileged ports or setting up networks (use `internal: true` and the daemon will automatically set up iptables rules that limit traffic). I deploy docker compose files with ansible so everything comes with built in security defaults like rootless, dropped caps, no new p…

I get the savings of Distroless, but when you have an issue it's a pain to debug.
Post reply on HN