The Route To Rootless Containers
summary
Describes adopting rootless containers for a large multi-tenant PaaS (Cloud Foundry), using runC and planned containerd rootless support, creating user namespaces that map container root to a high host UID (“Maximus”), and using newuidmap/newgidmap plus a small setuid setup step to create cgroup hierarchies. Implements layered roots with overlayfs on Ubuntu and XFS for per-app quotas via a setuid helper (TARDIS). Works end-to-end in many cases but production rollout is blocked by quota tooling, cgroup namespace gaps and privileged networking.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:26The Route To Rootless
- 1:34What is CF? Cloud Foundry
- 2:38What are containers?
- 5:08Things which make a container a container
- 7:31Dependencies
- 12:52Capabilities
- 13:39Seccomp
- 14:10Apparmor
- 15:32Make the things which make a container rootless
- 16:19User namespace
- 20:26Cgroups
- 21:07Rootfs Mounts
- 25:24What's left? (roadblocks)
- 27:32containerd
related talks
32mThe Route To Rootless Containers
44mRootless containers
35mThe Reality of Rootless Containers
38mUnderstanding root inside and outside a container
32mRoot Without Risk: A Decade-Long Quest for True Container Isolation
14mcontainerd: Rootless Containers 2020
31mTowards unprivileged container builds
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both