Security of Docker as it runs as root user

问题:

A Docker blog post indicates:

Docker containers are, by default, quite secure; especially if you take care of running your processes inside the containers as non-privileged users (i.e. non root)."

So, what is the security issue if I'm running as a root under the docker? I mean, it is quite secure if I take care of my processes as non-privileged users, so, how can I be harmful to host in a container as a root user? I'm just asking it to understand it, how can it be isolated if it is not secure when running as root? Which system calls can expose the host system then?

回答1:

When you run as root, you can access a broader range of kernel services. For instance, you can:

• manipulate network interfaces, routing tables, netfilter rules;
• create raw sockets (and generally speaking, "exotic" sockets, exercising code that has received less scrutiny than good old TCP and UDP);
• mount/unmount/remount filesystems;
• change file ownership, permissions, extended attributes, overriding regular permissions (i.e. using slightly different code paths);
• etc.

(It's interesting to note that all those examples are protected by capabilities.)

The key point is that as root, you can exercise more kernel code; if there is a vulnerability in that code, you can trigger it as root, but not as a regular user.

Additionally, if someone finds a way to break out of a container, if you break out as root, you can do much more damage than as a regular user, obviously.

回答2:

You can reboot host machine by echoing to /proc/sysrq-trigger on docker. Processes running as root in docker can do this.

This seems quite good reason not to run processes as root in docker ;)