github.com/coreos/rocket@v1.30.1-0.20200224141603-171c416fac02/Documentation/security.md (about)

     1  # Security best practices
     2  
     3  This document tries to give an overview of the security recommendations to follow when running rkt containers and discuss non-obvious communication channels between the host and the pod.
     4  
     5  ## General recommendations
     6  
     7  * **Don't run applications as root.** Use the [user and group fields][aci-schema] in your images or the `--user` and `--group` [CLI flags][rkt-run-subcommands] when running containers.
     8  * **Don't disable security features unless you really need it.** You should not use the `--insecure-options=` flag unless strictly necessary.
     9  * **Restrict capabilities given to your images as much as possible.** Only those actually needed by your app [should be granted][capabilities-guide].
    10  * **Tweak seccomp syscall filtering instead of disabling it.** The default seccomp profile might be too restrictive for your app. If that's the case, [tweak the seccomp profile][seccomp-guide] instead of disabling it.
    11  * **If you're not affected by its [current limitations][user-ns-limitations], use user namespaces.**
    12  * **Don't use host networking** since that will give the app in the container access to the host network interfaces and allow it to connect to any other application listening on the host, including on abstract Unix sockets.
    13  
    14  ## Volumes
    15  
    16  When using volumes, special care should be taken to avoid dangerous interactions with the host.
    17  Here are some security best practices:
    18  
    19  * **Use read-only volumes unless writing to them is necessary.**
    20  * If you use Linux v4.2 or older, **avoid sharing directories when tools on the host can move files outside the directory** (such as Nautilus moving directories to the trash bin when a user deletes it). This could expose the entire host filesystem to the container. See [moby/moby#12317 (comment)](https://github.com/moby/moby/issues/12317#issuecomment-92692061).
    21  * To avoid the previous point: **share a full filesystem instead of just a directory in a filesystem if possible**. For example, a mounted partition or some file mounted with `mount -o loop`.
    22  * **Sharing devices from the host to the container is generally not recommended**. If you need to do it, you can find examples in the [block devices documentation](block-devices.md).
    23  
    24  ## Incoming mounts
    25  
    26  Mounts can be added to a pod at runtime by using [`machinectl bind`][machinectl-bind] or when adding apps to a rkt pod with the [app experiment][app-experiment].
    27  
    28  This could be used in a malicious way although it requires privileges on the host.
    29  
    30  ## File descriptors
    31  
    32  In certain situations, some file descriptors belonging to the host namespaces are sent to the pod.
    33  
    34  ### Socket activation
    35  
    36  rkt supports [socket-activated services][rkt-socket-activated] and [socket-proxyd][socket-proxyd].
    37  This means some file descriptors will be passed from the host to the container when using those features.
    38  
    39  In particular, all file descriptors defined in the socket unit file accompanying the service file where rkt is started are passed to the container.
    40  
    41  ### sd\_notify
    42  
    43  rkt supports the [sd_notify][sd_notify] mechanism to notify systemd on the host that the pod is ready.
    44  This means systemd in the pod will receive a file descriptor which can be used to send information about whether the apps are initialized or not to the host.
    45  
    46  [aci-schema]: https://github.com/appc/spec/blob/master/spec/aci.md#image-manifest-schema
    47  [rkt-run-subcommands]: subcommands/run.md#options
    48  [capabilities-guide]: capabilities-guide.md
    49  [seccomp-guide]: seccomp-guide.md
    50  [user-ns-limitations]: devel/user-namespaces.md#current-limitations
    51  [rkt-socket-activated]: using-rkt-with-systemd.md#socket-activated-services
    52  [socket-proxyd]: using-rkt-with-systemd.md#bidirectionally-proxy-local-sockets-to-another-possibly-remote-socket
    53  [sd_notify]: https://www.freedesktop.org/software/systemd/man/sd_notify.html
    54  [machinectl-bind]: https://www.freedesktop.org/software/systemd/man/machinectl.html#bind%20NAME%20PATH%20%5BPATH%5D
    55  [app-experiment]: devel/pod-lifecycle.md#app