On 7/28/23 09:27, Mark Raynsford via Podman wrote:
On 2023-07-28T09:13:14 -0400 Daniel Walsh <dwalsh@redhat.com> wrote:
The issue with running all of your containers as a non root users, is if every container runs as a non-root user, then the containers would be allowed to attack the user account and every other container, if they were to escape confinement (SELinux). Hello!
I read back what I wrote and realized it was a bit ambiguous. To be clear: I'm running each container as a separate non-root user; one user ID per container (not one user ID shared between all containers).
Running containers with the least privs possible is always the goal, but it really is up to the application. This is where I'm still not entirely clear: Is running a container as root with SELinux and with flags such as --unprivileged=false really more powerful than as a regular user with the same kinds of flags? No a regular user is find, and since you are doing each podman run with a different user, you are doing it the most securely in my opinion, with a great deal of extra work, however. I haven't heard of anyone escaping SELinux confinement, although I'm guessing it has probably been done. I'd assume a kernel-level exploit would probably be required and, in that case, running under a different UID wouldn't help matters.
Well, none that I am aware of in the last few years, but I believe in Defense in Depth, I believe each security measure has a chance of failure, but the more you combine the less likely that the entire system is vulnerable.
I've tried setting up machines with all of the containers running as root, and it's certainly a lot less of an administrative burden. I run my own registry so I'm not _too_ concerned about hostile images making it into production containers.
I feel like there's a huge hole in the documentation around this subject, and it's really weird that noone appears to be talking about it. Fedora Server runs all containers as root if configured via Cockpit, so presumably someone at least considered the issue?
Well I do cover a lot of security concerns in my book Podman in Action, Chapters 10 and 11.
_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io