Nothing Special   »   [go: up one dir, main page]
Scribd Logo
Upload

Welcome to Scribd!

  • 116 views

    Session-102 (Rootless - Rootful Containers)

    Uploaded by

    Mohammed Babar Ahmed
    Containers)

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd

    Session-102 (Rootless - Rootful Containers)

    Uploaded by

    Mohammed Babar Ahmed
    116 views6 pages
    Containers)

    Original Title

    Session-102 (Rootless _ Rootful Containers)

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Containers)

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    116 views6 pages

    Session-102 (Rootless - Rootful Containers)

    Uploaded by

    Mohammed Babar Ahmed
    Containers)

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    of 6

    Rootfull Vs Rootless Containers in Linux:

    =========================================

    A rootful container is a container run by root in the host. Since it is run by


    root, it has access to all the functionality that root has.

    This does not mean that any process executed within the container would be run as
    root.

    As we have said, the container engines implement some functionality, segregation,


    and limitations that try to control what a process within the container can do.

    We will see how containers implement these limitations.

    However, at the end, if there is a vulnerability in the functionality that creates


    this isolation, the user within the container will be root on the host, and the
    compromise would be total.

    Docker containers are usually run as root, however, it seems that it is possible to
    execute them rootless (https://docs.docker.com/engine/security/rootless/).

    In order to have more security, an additional sound layer of security, someone


    thought it would be nice that the containers could be executed as a regular user.

    This is a challenge because the architecture of the containers was initially


    designed thinking that the user who executes them was root. However, with a lot of
    engineering and some tricks, rootless containers are possible.

    A rootless container is a container that could be run without root privileges in


    the host. Docker runs containers launching them with the Docker daemon, which is
    run as root.

    Podman does not use any daemon and it does not need root to run containers.

    “Rootless containers” does not mean that the user within the container is not root.
    It can be root, and by default it is, when using either Docker or Podman.

    Related to security, the main benefit of rootless containers is that even if the
    container engine, runtime, or orchestrator is compromised, the attacker won’t gain
    root privileges on the host.

    Rootless containers have limitations. Since they are executed as non-root, they
    don’t have access to all the features of the operating system. Some limitations are
    documented here https://github.com/containers/podman/blob/master/rootless.md. For
    example, you cannot publish a port below 1024.

    # dnf module list | grep container

    # dnf module install -y container-tools

    Rootful Containers:
    -------------------

    Running & managing containers from admin (root) user account.

    1. Manging & Modifying HTTPD Conatiner: Host your own page on container.

    # podman search httpd


    # podman pull docker.io/library/httpd

    # podman images
    REPOSITORY TAG IMAGE ID CREATED SIZE
    docker.io/library/httpd latest c58ef9bfbb57 2 weeks ago 148 MB

    # podman run -dit --name=mywebpage -p 8080:80 c58ef9bfbb57


    8501eb90ffcad210f4d5741152584270099a2e1d5f8959e0adec8be3c58d6f0c

    # podman ps
    CONTAINER ID IMAGE COMMAND CREATED
    STATUS PORTS NAMES
    8501eb90ffca docker.io/library/httpd:latest httpd-foreground 14 seconds ago Up
    14 seconds ago 0.0.0.0:8080->80/tcp mywebpage

    # podman logs 8501eb90ffca


    AH00558: httpd: Could not reliably determine the server's fully qualified domain
    name, using 10.88.0.2. Set the 'ServerName' directive globally to suppress this
    message

    # podman top -l
    USER PID PPID %CPU ELAPSED TTY TIME
    COMMAND
    root 1 0 0.000 56.921118504s pts/0 0s
    httpd -DFOREGROUND
    www-data 7 1 0.000 56.921248427s pts/0 0s
    httpd -DFOREGROUND
    www-data 8 1 0.000 56.921275417s pts/0 0s
    httpd -DFOREGROUND
    www-data 9 1 0.000 56.92130386s pts/0 0s
    httpd -DFOREGROUND

    # curl 192.168.196.128:8080
    <html><body><h1>It works!</h1></body></html>

    Check it using web browser also.

    # podman exec -it mywebpage /bin/bash


    root@8501eb90ffca:/usr/local/apache2#

    root@8501eb90ffca:/usr/local/apache2# ls
    bin build cgi-bin conf error htdocs icons include logs modules

    root@8501eb90ffca:/usr/local/apache2# cd htdocs/

    root@8501eb90ffca:/usr/local/apache2/htdocs# cat index.html


    <html><body><h1>It works!</h1></body></html>

    root@8501eb90ffca:/usr/local/apache2/htdocs# exit
    exit

    # mkdir /html

    # echo Please Subscribe Our Nehra Classes Youtube Channel. > /html/index.html

    # cat /html/index.html
    Please Subscribe Our Nehra Classes Youtube Channel.

    # chmod 777 -R /html/


    # ls -l /html/
    total 4
    -rwxrwxrwx. 1 root root 51 May 27 12:16 index.html

    # chcon -R -t httpd_sys_content_t /html/index.html

    # podman stop mywebpage

    # podman start mywebpage

    # podman stop -a

    # podman rm -a

    # podman run -dit --name=mywebpage -p 8080:80 -v /html/:/usr/local/apache2/htdocs/


    c58ef9bfbb57
    46d89e797eeb002af6254527ef82933debcd1246a0e6fc5674fc15552c730047

    # podman ps
    CONTAINER ID IMAGE COMMAND CREATED
    STATUS PORTS NAMES
    46d89e797eeb docker.io/library/httpd:latest httpd-foreground 3 seconds ago Up 3
    seconds ago 0.0.0.0:8080->80/tcp mywebpage

    # curl 192.168.196.128:8080
    Please Subscribe Our Nehra Classes Youtube Channel.

    Check it using web browser also.

    --------------------------------------

    2. Manging & Modifying MYSQL Conatiner: Setup & Connect to database.

    # podman search mysql

    # podman pull docker.io/library/mysql

    # podman images
    REPOSITORY TAG IMAGE ID CREATED SIZE
    docker.io/library/mysql latest b2500a44757f 3 days ago 529 MB
    docker.io/library/httpd latest c58ef9bfbb57 2 weeks ago 148 MB

    # podman run -d --name mysql -p 3306:3306 -e MYSQL_ROOT_PASSWORD='MyStr0ngP@ssw0rd'


    b2500a44757f
    29d8c22da25d892556302592ac1e9442e37ef90f74be86de1b2ee366d2c6b883

    # podman ps
    CONTAINER ID IMAGE COMMAND CREATED
    STATUS PORTS NAMES
    46d89e797eeb docker.io/library/httpd:latest httpd-foreground 9 minutes ago Up 9
    minutes ago 0.0.0.0:8080->80/tcp mywebpage
    29d8c22da25d docker.io/library/mysql:latest mysqld 4 seconds ago Up 4
    seconds ago 0.0.0.0:3306->3306/tcp mysql

    # [root@nehraclasses ~]# podman exec -it 29d8c22da25d /bin/bash


    root@29d8c22da25d:/# mysql -u root -p
    Enter password:
    Welcome to the MySQL monitor. Commands end with ; or \g.
    Your MySQL connection id is 8
    Server version: 8.0.29 MySQL Community Server - GPL

    Copyright (c) 2000, 2022, Oracle and/or its affiliates.

    Oracle is a registered trademark of Oracle Corporation and/or its


    affiliates. Other names may be trademarks of their respective
    owners.

    Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

    mysql> show DATABASES;


    +--------------------+
    | Database |
    +--------------------+
    | information_schema |
    | mysql |
    | performance_schema |
    | sys |
    +--------------------+
    4 rows in set (0.00 sec)

    mysql> create DATABASE nehra;


    Query OK, 1 row affected (0.01 sec)

    mysql> show DATABASES;


    +--------------------+
    | Database |
    +--------------------+
    | information_schema |
    | mysql |
    | nehra |
    | performance_schema |
    | sys |
    +--------------------+
    5 rows in set (0.00 sec)

    mysql> show WARNINGS;


    Empty set (0.00 sec)

    mysql> exit
    Bye

    ------------------------------------------

    Rootless Containers:

    Rootless containers refers to the ability for an unprivileged user to create, run
    and otherwise manage containers.

    1. Limitation of rootless containers: Can't mount container Filesystem on host.

    # su - vikasnehra

    $ su - vikasnehra
    [vikasnehra@nehraclasses ~]$ podman images
    REPOSITORY TAG IMAGE ID CREATED SIZE

    $ podman search myubi


    $ podman pull docker.io/myage/myubi

    $ podman images

    $ podman inspect cc0656847854

    $ podman info

    $ cd /home/vikasnehra/.local/share/containers/storage/

    $ podman run -itd --name=myubi cc0656847854

    $ podman ps

    $ podman exec -it 3fbdbdb2f0ae /bin/bash

    # cat /etc/os-release

    # exit

    $ podman mount 3fbdbdb2f0ae

    ---------------------------------------------

    2. Limitation of rootless containers: Can't use any port below number 1024.

    $ podman search httpd

    $ podman pull docker.io/library/httpd

    $ podman images

    $ podman run -dit --name=myhttpd -p 80:80 docker.io/library/httpd


    Error: rootlessport cannot expose privileged port 80, you can add
    'net.ipv4.ip_unprivileged_port_start=80' to /etc/sysctl.conf (currently 1024), or
    choose a larger port number (>= 1024): listen tcp 0.0.0.0:80: bind: permission
    denied

    $ podman rm myhttpd

    $ podman run -dit --name=myhttpd -p 800:80 docker.io/library/httpd


    Error: rootlessport cannot expose privileged port 800, you can add
    'net.ipv4.ip_unprivileged_port_start=800' to /etc/sysctl.conf (currently 1024), or
    choose a larger port number (>= 1024): listen tcp 0.0.0.0:800: bind: permission
    denied

    $ podman rm myhttpd

    $ podman run -dit --name=myhttpd -p 4444:80 docker.io/library/httpd


    93dfd8a27d16e71d91e5aa9009d44663dc4e9e4e7e75e48225627cc9e3f38f55

    $ podman ps
    CONTAINER ID IMAGE COMMAND CREATED
    STATUS PORTS NAMES
    3fbdbdb2f0ae docker.io/myage/myubi:latest /bin/bash 10 minutes ago Up
    10 minutes ago myubi
    93dfd8a27d16 docker.io/library/httpd:latest httpd-foreground 3 seconds ago Up
    4 seconds ago 0.0.0.0:4444->80/tcp myhttpd
    $ curl 192.168.196.128:4444
    <html><body><h1>It works!</h1></body></html>

    Check it from web browser also.

    ======================================

    You might also like