Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rootless Docker in a multi-user environment

cmtops.dev

Post reply on HN
Print view View original

41–50 of 50 posts

Re: Rootless Docker in a multi-user environment

#41

Post by itsphilos »

bjoli wrote: post #32
cpuguy83 wrote: post #25

Earlier quoted context omitted.

No both use the exact same techniques to achieve so called "rootless" which is generally considered to be insecure. Rootless docker stores images for the user executing it and that is all, same as podman.

How are they considered insecure?

I think OP is referring to the "unprivileged user namespaces" [1] feature of Linux, which caused numerous security incidents in the past. AFAIK, this is mainly because with this feature enabled, unprivilged users can create environments/namespaces which allow them to exploit kernel bugs much more easily. Most of them revolve around broken permission checks (read: root inside container but not outside, yet feature X falsely checks for the permissions _inside_). [2] has a nice list of CVEs caused by unprivileged user namespaces. Given that rootful docker e.g. is also prone to causing security issues, it's ultimately an attacker model / pick-your-poison situation though.

[1] https://www.man7.org/linux/man-pages/man7/user_namespaces.7....

[2] https://security.stackexchange.com/a/209533

Re: Rootless Docker in a multi-user environment

#42

Post by sarusso »

orhmeh09 wrote: post #37
sarusso wrote: post #11

Earlier quoted context omitted.

Oh man, Singularity… I once wrote: “In the shipping container analogy, you can think about Singularty containers as if they have no walls.” [1] [1] https://sarusso.github.io/blog/container-engines-runtimes-or...

Your claims here are inaccurate. You can pass flags or define environment variables to get the behavior you want. Please spend some more time hitting the man pages and the guide. > It indeed does not enforce (or even permit) robust isolation between the containers and the host, leaving large portions exposed. … More in detail, directories as the /home folder, /tmp, /proc, /sys, and /dev are all shared with the host,…

I actually went into every single line of the manuals and even discussed the matter on the official Singularity Slack.

In that blog post I wrote that it does not enforce. It is true that you can achieve some level of isolation by setting certain flags and environment variables explicitly, but this is (was?) quite hard to get working, moreover the user mapping inside the container is always host-dependant and there is just no network isolation.

To achieve something close to the behaviour "I wanted", I had to use a combination of the command line flags you mentioned (and in particular -cleanenv, -containall and -pid) together with custom-made, ad-hoc runtime sandboxing for directories which required write access (as /tmp and /home).

However, this is not the default behaviour and it is not how Singularity is used in practice by its users. But yes, I was able to achieve something close to the behaviour I wanted [1].

This said, if I am missing something, or if the project has evolved to allow for a better level of isolation by default, please let me know. That blog post is dated 2022 after all.

[1] https://www.sciencedirect.com/science/article/pii/S221313372...

Re: Rootless Docker in a multi-user environment

#43

Post by sarusso »

orhmeh09 wrote: post #38
grudg3 wrote: post #15

Earlier quoted context omitted.

Well, I'm glad I asked, appreciate your response and great blog post.

Pretty much everything the post says about Apptainer is untrue or inapplicable. See https://apptainer.org/docs/user/main/index.html

We are already discussing this here: https://news.ycombinator.com/item?id=40477166#40481115. No need to cross-discuss.

Re: Rootless Docker in a multi-user environment

#44

Post by IAmLiterallyAB »

nubinetwork wrote: post #40

What's the difference between this, and adding users to the docker group? As long as the docker daemon is running, you should be able to spin up containers without needing root.

The docker daemon is running as root in that scenario. So anyone in the Docker group can trivially become root by starting a privileged container.

Re: Rootless Docker in a multi-user environment

#45

Post by curt15 »

itsphilos wrote: post #41
bjoli wrote: post #32

Earlier quoted context omitted.

How are they considered insecure?

I think OP is referring to the "unprivileged user namespaces" [1] feature of Linux, which caused numerous security incidents in the past. AFAIK, this is mainly because with this feature enabled, unprivilged users can create environments/namespaces which allow them to exploit kernel bugs much more easily. Most of them revolve around broken permission checks (read: root inside container but not outside, yet feature X f…

Doesn't the Chromium sandbox, the gold standard for browser sandboxes, use user namespaces?

https://chromium.googlesource.com/chromium/src/+/HEAD/docs/l...

Re: Rootless Docker in a multi-user environment

#46

Post by fenollp »

lmeyerov wrote: post #6

Related: If you are into this kind of thing and the extra fun that is GPUs + pydata, we have a 1mo or 2mo project around adding rootless to our GPU graph AI containers & packer flow. Ping build@graphistry.com . Niche but a project we have been wanting for awhile. Base containers get OSS'd etc. This stuff is twisty!

What do you mean by "adding rootless"?

Re: Rootless Docker in a multi-user environment

#47

Post by Helmut10001 »

rducksherlock wrote: post #26
Helmut10001 wrote: post #23

Site is down? I am getting a connection refused.. Anyway, surprised that so many comments wonder about the usefulness of docker rootless in a shared environment. It is my main approach for separation of concerns in my homelab. I always use docker rootless to share resources with many isolated apps. I wrote a blog post about how to host Mastodon with docker rootless [1]. [1]: https://du.nkel.dev/blog/2023-12-12_mastod…

Possibly, the web server was down due to a large number of requests. I have a lot of stuff on the server running in containers, but limited my httpd instance to 1 CPU core and 1 GB of RAM. Better upgrade it, I guess.

I am still getting ERR_CONNECTION_REFUSED.

Re: Rootless Docker in a multi-user environment

#48

Post by rducksherlock »

Helmut10001 wrote: post #47
rducksherlock wrote: post #26

Earlier quoted context omitted.

Possibly, the web server was down due to a large number of requests. I have a lot of stuff on the server running in containers, but limited my httpd instance to 1 CPU core and 1 GB of RAM. Better upgrade it, I guess.

I am still getting ERR_CONNECTION_REFUSED.

Hmm, that's weird now.

I suspect, the problem may be with DNS, since my domain used to point to another IP less than a week ago.

Try to flush the DNS cache, or to connect from another device.

Also, try this link: cmtops.dev/posts/rootless-docker-in-multiuser-environment/

Re: Rootless Docker in a multi-user environment

#49

Post by Helmut10001 »

rducksherlock wrote: post #48
Helmut10001 wrote: post #47

Earlier quoted context omitted.

I am still getting ERR_CONNECTION_REFUSED.

Hmm, that's weird now. I suspect, the problem may be with DNS, since my domain used to point to another IP less than a week ago. Try to flush the DNS cache, or to connect from another device. Also, try this link: cmtops.dev/posts/rootless-docker-in-multiuser-environment/

cmtops.dev/posts/rootless-docker-in-multiuser-environment/ also gives me ERR_CONNECTION_REFUSED

Btw. this is from Germany. A geoblock?

Re: Rootless Docker in a multi-user environment

#50

Post by rducksherlock »

Helmut10001 wrote: post #49
rducksherlock wrote: post #48

Earlier quoted context omitted.

Hmm, that's weird now. I suspect, the problem may be with DNS, since my domain used to point to another IP less than a week ago. Try to flush the DNS cache, or to connect from another device. Also, try this link: cmtops.dev/posts/rootless-docker-in-multiuser-environment/

cmtops.dev/posts/rootless-docker-in-multiuser-environment/ also gives me ERR_CONNECTION_REFUSED Btw. this is from Germany. A geoblock?

No, I never geoblock people because that's stupid and annoying.

I will look into it this week. Busy at work, sorry.

You can write me an email to timofey.chuchkanov@cmtops.dev, so we can continue this troubleshoot later without flooding here.

Post reply on HN