The document summarizes a presentation given by Andrew Denner to the Central Iowa Linux Users Group about Docker and rootless Docker. It begins with welcome information about the meeting and introduces the presenter. Andrew Denner then gives a brief introduction to Docker, comparing it to shipping containers, and discusses the benefits of using Docker. He notes some limitations of running Docker as root and introduces the concept of rootless Docker as a more secure alternative, explaining how it works using user namespaces to simulate root access within containers run by non-root users.

2. WELCOME TO CIALUG
• Meetings are the third Wednesday of the month
• Thank you to this month’s host Source Allies
• Next meeting at the 515 Maker’s Space? (watch for more details) on IoT
• Connect up with us:
• https://cialug.org
• Email list
• Slack and IRC

3. A LITTLE ABOUT ME
• Andrew Denner
• @adenner
• Software Developer by day,
Linux enthusiast at night
• Recently back from
Dockercon
• Slides will be emailed out
and posted to
https://denner.co

4. ON WITH THE SHOW

5. A BRIEF INTRO TO DOCKER
(AND ROOTLESS DOCKER)
ANDREW DENNER
CENTRAL IOWA LINUX USERS GROUP

6. THANKS TO:
• Some of the information is rehashed from two presentations at dockercon.
The videos are in the link below and are worth watching! Thanks to Akihiro
Suda of NTT Corporation and Michael Irwin of Virginia Tech
• https://www.docker.com/dockercon/2019-videos/
• https://www.docker.com/dockercon/2019-videos?watch=hardening-docker-
daemon-with-rootless-mode
• https://www.docker.com/dockercon/2019-videos?watch=containers-for-
beginners

7. IT’S ALL
ABOUT
SHIPPING
IN THE BEGINNING, MORE TIME
WAS SPENT LOADING AND
UNLOADING IN PORT THAN IN
TRAVEL

8. IF IT FITS IT SHIPS
CONTAINERS STANDARDIZED THE PROCESS
AND MAKES IT EASY FOR LOADING AND
UNLOADING

9. THE WHITE ZONE
IS FOR LOADING
AND UNLOADING
OF PASSENGERS
ONLY
THERE IS NEVER ANY PARKING IN THE WHITE
ZONE…

11. MULTI-MODAL
SHIPPING IS
EASIER
BOAT TO TRAIN TO TRUCK

12. WHAT DOES SHIPPING HAVE TO DO WITH ANYTHING
• Old way was order hardware, install os, software etc
• Took lots of time, hard to reproduce
• “Well it worked on my machine”
• Shipping container idea… enter docker

14. Credit: Containers for beginners

15. THINGS TO
REMEMBER
• All containers are sharing the same kernel as
the host
• Not really anything new, just nice package of a
bunch of older techs
• Docker daemon is running as root
• You can mount files in filesystem, if root inside
you are root outside
• If you can escape your container, remember
docker daemon is root!

16. WHAT IF WE DIDN’T HAVE
TO RUN AS ROOT?

17. IT EXISTS NOW… KINDA
• You can run it right now… shell script installer will take care of the
magic
• curl -fsSL https://get.docker.com/rootless | sh
• Katacoda example
https://www.katacoda.com/courses/docker/rootless

18. WHAT’S THE CATCH?
• No Overlay fs (except for ubuntu)
• Network performance is degraded
• Ports below 1024 can’t be listened on (remember you are not root)
• No cgroups
• --memory and -- cpu flags don’t work
• Docker top doesn’t work
• You need to be in /etc/subuid and /etc/subgid (this can be a problem in
LDAP)

19. WHILE MORE SECURE IT’S NOT PERFECT
• There is still room for abuse
• Won’t stop someone from bitcoin mining inside of docker
• Can use as a springboard for further attacks
• Still can fall for vm /kernel/hardware vulnerabilities

20. HOW DOES IT WORK?
• User namespaces allow non root users to pretend that they are root (UID0)

21. Sub-users (and sub-groups)
● If /etc/subuid contains “1001:100000:65536”
● Having 65536 sub-users should be enough for most
containers
0 1001 100000 165535 232
0 1 65536
Host
UserNS
primary user sub-users start sub-users len