Securing Filesystem Images for Unprivileged Containers

on YouTube ↗42m

" summary

Claims that unprivileged containers can run bare‑metal in production using only user namespaces and shows prototypes for fixing UID/GID mismatch when sharing images: an in‑kernel shiftfs (a subtree bind with range maps) and a portable rootfs approach that marks superblocks for translation. Demo uses bindfs/shiftfs style mounts (module not loaded so demo partially fails), Docker currently resorts to putting real root inside containers, and neither solution is upstream yet so permissions and attack surface remain unresolved.

AI-written summary · about

" chapters (12)

1. 0:00Start
2. 1:10Kernel Api for Containers
3. 3:19Namespaces
4. 4:16The Pid Namespace
5. 7:41Setting Up a Container without Root Privileges
6. 9:30State of Unprivileged Containers
7. 13:28Set Groups
8. 14:49Set Up Unprivileged Containers
9. 16:36Container Images
10. 20:24Bind Fs
11. 25:10Portable Root File System
12. 39:46Conclusion

" related talks

• 45mMaking Containers SaferChristian Brauner, Stephane Graber · Linux Security Summit North America 2019
• 01h 31mTutorial: Using Linux Primitives to Build Your Own ContainersChristian Brauner, Stephane Graber · Linux Security Summit Europe 2019
• 31mTowards unprivileged container buildsAlban Crequy · ContainerDays Hamburg 2018
• 48mState of Linux Kernel Container FeaturesChristian Brauner, Stephane Graber · LinuxCon @ OSS NA 2023
• 44mRootless containersAkihiro Suda, Giuseppe Scrivano · DevConf.CZ 2019
• 32mThe Route To Rootless ContainersEd King, Julz Friedman · KubeCon + CloudNativeCon Europe 2018
• 01h 32mContainers – A Look Under the HoodGerlof Langeveld · ContainerCon @ Open Source Summit Europe 2022
• 45mSecuring Container Runtimes -- How Hard Can It Be?Aleksa Sarai · linux.conf.au 2020