‫All right. We know not to run as root in the container.
‫But, outside the container, the root in the container,
‫by the way, doesn't have a direct access
‫to anything on the host, right. Just because you're root in
‫a container, you're still jailed in there.
‫But, if you want
‫to take that next level, where if the user even has root in
‫the container, wants to break out to the host, because
‫there is a kernel of vulnerability like we talked about,
‫like dirty Cow or another vulnerability in Docker
‫or something.
‫Then, the next step you do here is enabling user
‫namespaces, which is not enabled by default.
‫I have a link here that takes to a blog article that talks
‫all about it.
‫Basically, it's a per host setting that you set in the
‫Docker configuration. The Docker JSON.
‫It tells Docker that any
‫time it creates a new container to
‫run that container as a non root user on the host.
‫So, basically there's a couple of programs there,
‫containerd and runC, which are other programs that Docker
‫uses to start your container.
‫By default, those do run as root.
‫A feature that Docker has is to enable user
‫namespaces, which essentially means as
‫Docker creates these containers, it won't spawn them off as
‫a sub process that's running as root like Docker does.
‫It will spawn them as a high numbered user.
‫A sort of, not necessarily a random user, but a high level
‫user.
‫That means if that container ever has
‫any security vulnerabilities where the user is able to
‫escape the container, there's still only going to be a user
‫on the host. Because that's they're going to be acting as
‫the user that the process that's running that container
‫is using. The runC essentially.
‫The runC program is what launches that container, and
‫it will be running as a high numbered user, not
‫root. That user doesn't really have any privileges outside
‫that container. So, that feature is
‫a per host setting, not a per container setting, and
‫not everything works under user namespaces.
‫You're just going to have to try and practice.
‫You're going to have to enable it on some servers,
‫try your applications on that server, see if they work.
‫If they don't, you're going to have to segment your
‫architecture. Whenever I implement user namespaces
‫in a cluster, we typically have specific worker nodes
‫that have user namespaces enabled.
‫That's where those programs run that can support it, that
‫work with it.
‫Everything else has to run on regular Docker servers
‫somewhere else. That's kind of how we segment it out.
‫We segment into two classes of servers.
‫That, you know, like if you're running a DMZ, that's what I
‫would do is I'd run, I'd enable, in the DMZ, all the
‫user namespaces, on all the servers, and then the
‫containers that run there would have to be, would have to
‫support user namespaces.
‫You can't go look at applications and find out if they
‫support user namespaces.
‫It's a...user namespaces is not necessarily a Docker
‫specific feature. It essentially means your container is
‫running in a namespace and now
‫the application running that container is also locked
‫down a little bit.
‫Not everything can support that. You're going to just have
‫to practice or maybe do some research to see if other
‫people have been able to get it to work under
‫there. You know, for common things like MySQL and stuff
‫like that. But obviously, for your own programs that you're
‫developing, you're just going to have to test them to see
‫if they'll work. I'd say most programs and common
‫languages that I run, they work just fine in user
‫namespaces. The real issue with user namespaces is when you
‫have an application that needs to write to volumes, or to
‫bind mounts, that maybe you've got user file
‫uploads and you're sharing those across many different
‫containers. That's where user namespaces isn't impossible.
‫It just gets a little tricky because the
‫files that are now written to disk on the host
‫are now being written as a different user.
‫Because that process on the host that's managing
‫the container is a different user.
‫So, you'll see different user IDs on those files,
‫and you're just going to have to deal with that.
‫There's standard Linux permissions at that point, and
‫you just have to automate and solve those problems in
‫various Linux standard ways.
‫It's not even really a Docker problem at that point.
‫It's just a permissions problem on the host.