News for hackers. Stuff that matters.

A comment on Rootless Docker in a Multi-User Environment – It's All About Context. Parent comment

Re:Rootless Docker in a Multi-User Environment – It's All Ab... by sarusso on Saturday May 25, 2024 @08:58PM (#40478997)
If it works as I understood, in this setup I can see an advantage at an architectural level: in Podman containers images are stored on a per-user basis, while in this setup they would be shared between users, thus using much less disk space (if using the same base images). Besides this, I actually have the same question.
[ Parent | on HN ]
Re:Rootless Docker in a Multi-User Environment – It's All Ab... by cpuguy83 on Sunday May 26, 2024 @12:41AM (#40479818)
No both use the exact same techniques to achieve so called "rootless" which is generally considered to be insecure.

Rootless docker stores images for the user executing it and that is all, same as podman.

[ Parent | on HN ]
Re:Rootless Docker in a Multi-User Environment – It's All Ab... by bjoli on Sunday May 26, 2024 @01:49AM (#40480033)
How are they considered insecure?
[ Parent | on HN ]
Re:Rootless Docker in a Multi-User Environment – It's All Ab... by itsphilos on Sunday May 26, 2024 @07:41AM (#40481401)
I think OP is referring to the "unprivileged user namespaces" [1] feature of Linux, which caused numerous security incidents in the past. AFAIK, this is mainly because with this feature enabled, unprivilged users can create environments/namespaces which allow them to exploit kernel bugs much more easily. Most of them revolve around broken permission checks (read: root inside container but not outside, yet feature X falsely checks for the permissions _inside_). [2] has a nice list of CVEs caused by unprivileged user namespaces. Given that rootful docker e.g. is also prone to causing security issues, it's ultimately an attacker model / pick-your-poison situation though.

[1] https://www.man7.org/linux/man-pages/man7/user_namespaces.7....

[2] https://security.stackexchange.com/a/209533

[ Parent | on HN ]
Re:Rootless Docker in a Multi-User Environment – It's All Ab... by curt15 on Sunday May 26, 2024 @09:10AM (#40481886)
Doesn't the Chromium sandbox, the gold standard for browser sandboxes, use user namespaces?

https://chromium.googlesource.com/chromium/src/+/HEAD/docs/l...

[ Parent | on HN ]
Re:Rootless Docker in a Multi-User Environment – It's All Ab... by sarusso on Sunday May 26, 2024 @06:30AM (#40481072)
Ok, but here the OP is doing something a bit different than just rootless Docker, which is to use a "centralised" rootless Docker running as a single, non-privileged user... or am I missing something?
[ Parent | on HN ]