State of Linux Kernel Container Features
summary
Current kernel work makes unprivileged containers practical: unprivileged user namespaces can be blocked via an LSM hook and distributions no longer must patch the kernel; container managers use unshare and user namespace mappings so root-in-container maps to high host UIDs (e.g. 1,000,000). Security gains come from Landlock and the BPF LSM for fine‑grained, programmable policies and from seccomp notify intercepting mounts and delegating them to a privileged userspace helper, while the new FD‑based mount API supports detached mounts and idmap mounts for safe mount injection; avoid privileged containers.
AI-written summary · about
chapters (5)
related talks
01h 31mTutorial: Using Linux Primitives to Build Your Own Containers
47mLinux user namespaces: a blessing and a curse
42mSecuring Filesystem Images for Unprivileged Containers
33mLinux Container Internals
01h 32mContainers – A Look Under the Hood
50mImproving Container Security with System Call Interception
31mTowards unprivileged container builds
23mLife of a Container