How do I prevent root access to my docker container

by

As David mentions, once someone has access to the docker socket (either via API or with the docker CLI), that typically means they have root access to your host. It’s trivial to use that access to run a privileged container with host namespaces and volume mounts that let the attacker do just about anything.

When you need to initialize a container with steps that run as root, I do recommend gosu over something like su since su was not designed for containers and will leave a process running as the root pid. Make sure that you exec the call to gosu and that will eliminate anything running as root. However, the user you start the container as is the same as the user used for docker exec, and since you need to start as root, your exec will run as root unless you override it with a -u flag.

There are additional steps you can take to lock down docker in general:

  1. Use user namespaces. These are defined on the entire daemon, require that you destroy all containers, and pull images again, since the uid mapping affects the storage of image layers. The user namespace offsets the uid’s used by docker so that root inside the container is not root on the host, while inside the container you can still bind to low numbered ports and run administrative activities.

  2. Consider authz plugins. Open policy agent and Twistlock are two that I know of, though I don’t know if either would allow you to restrict the user of a docker exec command. They likely require that you give users a certificate to connect to docker rather than giving them direct access to the docker socket since the socket doesn’t have any user details included in API requests it receives.

  3. Consider rootless docker. This is still experimental, but since docker is not running as root, it has no access back to the host to perform root activities, mitigating many of the issues seen when containers are run as root.

More Related Contents:

  1. Interactive shell using Docker Compose
  2. Docker Compose + Spring Boot + Postgres connection
  3. Docker-compose check if mysql connection is ready
  4. MYSQL_ROOT_PASSWORD is set but getting “Access denied for user ‘root’@’localhost’ (using password: YES)” in docker container
  5. How to pass arguments within docker-compose?
  6. How to correctly link php-fpm and Nginx Docker containers?
  7. What does set -e and exec “$@” do for docker entrypoint scripts?
  8. How to check if a process is running inside docker container?
  9. Docker COPY from ubuntu absolute path
  10. Docker: How to use bash with an Alpine based docker image?
  11. Why the “none” image appears in Docker and how can we avoid it
  12. How to mount local volumes in docker machine
  13. An error, “failed to solve with frontend dockerfile.v0”
  14. Difference between links and depends_on in docker_compose.yml
  15. How to pass ARG value to ENTRYPOINT?
  16. nginx: use environment variables
  17. How to pass arguments to a Dockerfile?
  18. How to set uid and gid in Docker Compose?
  19. How do I kill background processes / jobs when my shell script exits?
  20. Multiple FROMs – what it means
  21. What is /dev/null 2>&1?
  22. How to create a DB for MongoDB container on start up?
  23. Using find to locate files that match one of multiple patterns
  24. How to get “wc -l” to print just the number of lines without file name?
  25. How do I mount a host directory as a volume in docker compose
  26. COPY with docker but with exclusion
  27. Block Comments in a Shell Script
  28. Emacs shell scripts – how to put initial options into the script?
  29. Pass groovy variable to shell script
  30. Awk replace a column with its hash value

Leave a Comment