Understanding root inside and outside a container
summary
Concrete demos show running containers as root or a regular user changes three different things: the engine user, the in-container process UID, and the host UID mapping in /proc. Live examples use podman vs docker to show daemonless rootless runs, use /proc and passwd to illustrate real/effective/saved UIDs, and demonstrate that user namespaces map to subuid/subgid while --privileged disables SELinux and seccomp. Roadmap items: CRI-O runtime class for usernamepaces, NFS xattrs to carry high UIDs, and freeIPA to sync subuid maps.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:36Demos
- 5:18What is root
- 8:30Real ID
- 14:14Container constraints
- 20:36Dash privilege
- 21:30Kernel
- 22:32Demo
- 22:44Mount root
- 23:29Constraints
- 25:08User privilege
- 28:12Root as a regular user
- 30:38NFS and containers
- 33:21Freeipa
- 34:58Docker
related talks
35mThe Reality of Rootless Containers
30mThe Route To Rootless Containers
22mRun As “Root”, Not Root: User Namespaces In K8s
40mRootless Containers with Podman
44mRootless containers
38mBringing Containers to Enterprise
32mThe Route To Rootless Containers
54mContainers unplugged: understanding user namespaces