containerd: Rootless Containers 2020
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Tuesday, 2020-11-17· at 15:55· Intrado Virtual Event Platform,·
summary
Runs container runtimes and containers without root privileges so the attack surface of runc, containerd, kubelet is reduced; mitigates breakout and misconfiguration risks but not DDoS or cryptomining. Practical pieces: Docker rootless ships (experimental in 19.03, GA in 20.10), BuildKit and rootlesskit work for image builds, and clusters gained cgroups v2 support in 2019 to enforce memory/CPU limits. Kernel features matter: seccomp user notification landed around 5.0 and kernel 5.9 adds seccomp ioctl FD to cut overhead, and hands-on demos show this stack actually runs without root.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:33What is Rootless Containers? Virtual
- 1:32Why do we need Rootless?
- 3:37Not a panacea, of course...
- 4:22History
- 6:29Example: Docker
- 7:39Example: Usernetes
- 8:26Example: k3s
- 8:54Example: BuildKit
- 9:51How it works
- 13:11Recap
- 13:48Resources
- 14:00Questions?
related talks
32mRoot Without Risk: A Decade-Long Quest for True Container Isolation
22mHardening Docker Daemon with Rootless Mode
44mRootless containers
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown
30mThe Route To Rootless Containers
31mTowards unprivileged container builds
32mThe Route To Rootless Containers
33mContainers Security Layers and How Not to Break them