The Route To Rootless Containers
summary
Cloud Foundry moves container creation out of root by using user namespaces so processes are UID 0 only inside their namespace, and runC now leverages the distro tool newuidmap to write UID mappings. Layered filesystems use overlayfs (Ubuntu whitelist) after btrfs snapshots fail at scale, and cgroups are pre-provisioned by a privileged setup phase. Disk quotas and networking still require small setuid helpers, but the system passes CF tests and is available behind an experimental flag for near-term production rollout.
AI-written summary · about
chapters (15)
- 0:00Intro
- 2:04Cloud Foundry
- 3:31Container Security
- 5:42Isolation
- 8:05Security Onion
- 10:55Resource Sharing
- 11:49Encapsulation
- 14:50Side Notes
- 15:41Why Are We Secure
- 17:00Shoutouts
- 17:33User Name Spaces
- 21:28ResourceSharing
- 22:54File Systems
- 26:22Remaining Roadblocks
- 28:47Summary
related talks
30mThe Route To Rootless Containers
44mRootless containers
35mThe Reality of Rootless Containers
38mUnderstanding root inside and outside a container
42mSecuring Filesystem Images for Unprivileged Containers
31mTowards unprivileged container builds
14mcontainerd: Rootless Containers 2020
32mRoot Without Risk: A Decade-Long Quest for True Container Isolation