On 2020-01-18 08:26, Robert P. J. Day wrote:

colleague just presented me with this question ... he was following an example that showed how, when started with docker, a process running as root in the container was also running as root on the host. the example he showed me was to fire up an alpine image, verify that the user account was root inside the container, then start a "sleep 100" command, open another terminal on the host, and check the properties of running sleep commands, whereupon he saw:

$ ps -fC sleep UID ... CMD root sleep 100 $

i did exactly the same thing on my fedora 31 system but i have docker aliased to podman, and when i did the same thing, back on the host, i got:

$ ps -fC sleep UID PID PPID C STIME TTY TIME CMD rpjday 24268 21319 0 08:23 pts/0 00:00:00 sleep 42

in short, while the sleep process was owned by root in the container, on the host, it is clearly owned by me.

i wasn't sure how to explain that, other than to suggest that podman, by default, doesn't map root in container to root on host. is there an explanation i could point him to to understand why running under podman behaved differently? thanks.

rday

It looks like you're running Podman without root here; your colleague may be doing the same, but it's likely because he added his user to the Docker group, giving him access to the Docker API socket. This allows his user to connect to the Docker daemon, running as root, and run containers with full root privileges (it's effectively the same as giving a user passwordless sudo). Podman, however, does not have a daemon. If you take a look at the Podman binary, you're also notice that it's not setuid/setgid; when Podman is run without root, we run containers with no added privileges that the user who ran the container does not have. This is a major security benefit (though there are certain things you can't do in a rootless Podman container, such as making changes to the system that would require root; some VPNs need to do this, for example). Inside the container, you'll likely see that the command you're running believes that it is UID 0, even though your `ps` command shows that it is running as your user. This is thanks to user namespaces. We map your user into the container as UID 0, which allows you to act as root within the container. On the outside of the container, though, the container process is still your user (which is why you can't make system policy changes - normal security policy prevents unprivileged users from doing these things, so the container running as your user is no different). If you were to run a Podman container as root using sudo or su, you'll see that the container process is actually root on the system - no user namespace is used, as we already have full privileges, and don't need one. I hope this answers your question, but feel free to ask follow-ups if anything is unclear. Thanks, Matt Heon

_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io