Docker Processes Shown on Host Process List

Question

I was setting up a Selenium server using docker, basically following this github tutorial.

I have no problem setting up the server, but I noticed that the processes that I started inside the docker image actually got shown up on my host process list.

As you can see in the screen shot, the docker ran a bash script and also executed a jar file, which I assume should only happen inside the box. Does this mean the user from the host could possibly kill a certain process outside the container which will totally screw up the world inside the box?

When I stopped the container, all the processes went away as I expected.

Is this the way Docker is designed for.. and the flawed isolation is what you have to accept in trade for the lightweight comparing with Virtualbox/Vagrant... or I am doing anything wrong?

Thanks!

Answer 1

Yes, this is as intended. Notice that the processes are started by root, so a user with root privileges can kill them, but a user with root privileges can do worse than that (e.g., uninstall docker o_O)...

This "flawed" isolation actually has some great benefits, like the ability to monitor the processes running inside all your containers from a single monitor process running on the host machine.

Answer 2

This seems to be a common misconception about Docker being lightweight virtual machine" that is why some might expect similar behavior as VirtualBox or VMWare but just faster.

Docker does not use virtualization, so all processes run by the native host kernel just isolated from each other. Non-root user cannot kill processes inside container, but root can stop the entire container not only kill a process.

To distinguish between processes running inside container and others, run top then press shift+f and select the nsPID and nsUSER as shown in the attached screenshot.

Then you will see beside each process the namespace if it is running on the server directly this value most likely will be empty and if the process running inside a container you will see the namespace id for each container. (you can sort by the namespace to see processes in each container)

Answer 3

Also be aware that the user on the host can kill processes in the container started by the same uid.

This is particularly of concern because there's a good chance the first user added in the container has the same uid as the first user created on the host.

$ ps -ef |grep '^install+ 26184'
install+ 26184 26177  1 Oct30 ?        00:18:18 /usr/lib/plexmediaserver/Plex Media Server

$ kill -9 26184

$ ps -ef |grep '^install+ 26184'

Note that the first column shows my own user name because the process is running in the container with my uid, and that I killed the process without sudo or admin privileges.

So the takeaway is to either:

• Create a new account and group on both the host and container, to ensure the same uid/gid isn't used; or
• Enable Docker user namespaces to map the uid and gid.