Left over on your screen is Dmitri. 1
I think this is your first time on the show right. 2
Yeah. 3
All right. 4
This is the first time on. 5
So thanks for having me. 6
Yeah. 7
And he's right now in Greece but he's actually normally in Barcelona running the darker Barcelona meetup. 8
He is the founder at Harbor cloud solutions and I'm super excited him on the show because he's going 9
to talk to us about rootless Docker which is a brand new thing this year and we'll talk about why that's 10
important and why you might want to check it out. 11
Dimitri what's the elevator pitch to someone who knows containers and they know how to run Docker now 12
why should they care about rootless Docker. 13
Yeah so basically. 14
First of all why do we need containers in the first place. 15
Basically what we want to do with containers is that we want to isolate the applications inside their 16
specific user space so that they can not do things outside of that space and isolate them. 17
And in that context. 18
But once someone once is able to run containers what we know is that if normally what we say if you 19
have access to the doctors socket then basically you are out of the application of of the operating 20
system. 21
And basically this means that if someone can access the doctor so I can then choose a route on the on 22
the operating system and we don't want that. 23
You basically want someone to be able to have isolated thought and not being able to do these kinds 24
of things and write with them with the story with a bat basically with truth that is what we can say 25
we are able to do is that. 26
Am sorry. 27
Hang. 28
Yeah. 29
I would like a severe brain freeze right now. 30
No that's okay. 31
So yeah basically with rootkit is what we have is the ability in order to run containers but not with 32
toxicity that the operating system so someone can not on some containers without being rude. 33
So if someone breaks out of that container then he cannot access the operating system let's say so. 34
Right. 35
Basically what you do is is duplicate some kind of X and another layer of security on top of the containers. 36
Right. 37
So this means that also if I want to run a docker container if I'm running in ruthless mode does that 38
mean I don't even need route I can just be a regular user. 39
Yeah exactly. 40
So basically if you you don't need the ruby in order to be able to install Docker in some machine and 41
you can use Dr. Oz as a normal user of that that specific machine and you can create containers as if 42
you are a route but and create some users some some containers. 43
But you don't need to access that specific machine. 44
Yeah. 45
So basically there are two kinds of benefits in two different regions Jane two different type of users 46
let's say ones are the users that there are developers maybe they don't share the route accessing that 47
specific machine that they are working on and now with the characters they can install the doctor without 48
giving route access and they can use that in order to put on containers in their own environment and 49
the other one is if you are an operator or a if you're using that if you have a class there for example 50
that you want to kind of in your own cluster and you don't go to run containers using a doctor in route 51
mode but you want to use it being in a user long thing in a specific user so that even if someone breaks 52
out of that specific container then you cannot access the route to that specific machine. 53
So you have a basically. 54
And one more layer of security contact specially from the scene right. 55
And basically that's that's the idea and you say you should have some kind of restrictions. 56
But we're going to see that on the demo. 57
But basically you can do whatever you can do normally with containers. 58
Yeah well let's go. 59
Let's do it let's get to some demos. 60
I think sometimes it's great to talk about something but it's also cool to see. 61
Let's go to the demo there. 62
OK. 63
So basically what we have here is you've created a spaceship. 64
My machine is a Mac so I can there. 65
So the doctor ruthless in my max because basically we want to have a Linux kernel on it. 66
And so what I'm using is I'm using a vagrant and virtual box in order to run virtual machines and virtual 67
boxes a virtual machine runtime and what kind is it. 68
Basically a provider for which all machines in my in vitro box. 69
And this is basically my configuration. 70
I have two specific machines that I'm creating. 71
One is a ruthless which is born two of the Sanyo version 64 and the other is four basically. 72
So what we want these ruthless is I'm going to do an installation of in the ruthless mode in the road 73
for. 74
Basically I'm going to do a normal installation of Docker and I shave them already running 75
and there's tattoos. 76
You'll see that these machines are running 77
once. 78
Okay so on the touch screen I'm going to log into a ruthless machine and the bottom screen I'm going 79
to say it's too little too late. 80
I like rueful Yeah I don't know if it's written like that but that's sounds. 81
We just made up a new word rueful that wasn't a thing it's now a thing. 82
OK. 83
So how are we going to install ruthless mode here. 84
So I'm just going to show you what are the commands for it. 85
And then I have a script which is the set up here which basically what I the only thing that they need 86
in order to prepare the operating system the Born to send young 64 version is I want to activate the 87
IP tables in the cabinet. 88
I want to have that then basically what I want to do is I want to install Docker with these these command. 89
Basically this is a script that said yeah let's call ruthless. 90
And normally you should not accept scripts from the Internet like and like that. 91
But let's say that we would know the audience in Okay it's. 92
We are at least SSL over to Dockers you are ell so it would have to require someone to take advantage 93
of that. 94
But you can always always pull it down. 95
Exactly. 96
You can not pull it down. 97
If you eat and then execute it right. 98
Yeah. 99
So I already executed in the start before so it basically knows that I already installed it. 100
But if you're in the first machine with this should be sufficient in order to install the ruthless mode 101
and what their Kozmo does is create their service in the System D which basically runs inside your home 102
directory. 103
So you see this is the other service inside my home background which is my user name and in that machine 104
and there is there where the the system the service is installed. 105
And if you see the binary for example use these the background being the the ruthless in experimental 106
mode and these terms that I was overlay and once I have these installed if I like it appears it will 107
not do anything because I don't show having device on the [REMOVED] it I don't ever run into anything there 108
because my socket right now is inside this user space in the wrong user a thousand Docker socket. 109
So I need to export these Docker host and now had the bigger Piers then you can see that I can I can 110
use that can I get a ticket if I do care for the world for example you can see that now I can run things 111
inside the container and there appears for example and don't have anything. 112
And see here you can see that the containers that already run in the full environment that do the same 113
thing here. 114
And in order to install it they're basically the command is this one and it's the get Docker and then 115
you download the script you execute it and once you execute it 116
and you have everything but I already have it installed so I'm just going to stop it now. 117
And once you have it installed then you can see a doctor is running. 118
So let's see now what are the difference between these two environments. 119
If I do a B.S. here and speak about the care you will see that my doctor is running US route and it's 120
running in these with these command instead and here if I said for a doctor you will see that there 121
are some other commands that because it's using brutalist kit and if you see all of those commands running 122
in user background. 123
So there is no road user are running anything. 124
And that's that's basically the biggest difference between those two and so let's try and run the same 125
commands on both machines that you're on. 126
Hello world. 127
You will see that this runs the same thing and let's see some other things that we can run at. 128
First of all I would like to say some one. 129
One other difference a if you are in the 130
in the road for my scene here right now you can see that Dr. Pierce is running directly but this is 131
because if we're taking the groups you can see that. 132
I have the doctor group here. 133
And if I go and log in as I think there's another bone to use here and if I do that Europeans I cannot 134
do anything with the socket. 135
And this is because I don't belong to the doctor group. 136
So this is one of the difference that if you belong to the doctor group then basically you have access 137
to the doctor socket. 138
And if you don't belong to the group then basically you need to do a show to do that. 139
Yes. 140
And this is one way of accessing the socket in the wrathful machine and another and other ways to use 141
the group. 142
And the big difference here on the ruthless is that you don't need both neither of those. 143
You don't need to have and so do to some kind of socket that belongs to another user. 144
You just ran it in your own user space everything and. 145
OK so let's see some other commands for example the two were eyes. 146
Things that are running inside the room full. 147
If we took to the virally the clear overlay this is where our overlays are running inside the edit for 148
the environment but if we check the same thing here you will see that they don't have anything there. 149
And this is because everything is running in our own user space. 150
And I can find these things in this directory which is the local Sir Doctor. 151
And then here you can see the overlay that occurs and you can see that these are inside the same user 152
patient. 153
My own user. 154
So in our defense that we can find for example use that. 155
Let's run something now. 156
She's exposing a board. 157
So I am running an engine X and I'm running it and exposing it in the thirty two thousand seven hundred 158
sixty eight port and then went into the same shit. 159
So 160
yeah that's something like this 161
okay. 162
So if I don't know. 163
Okay. 164
Now I'm sure you can see the ends in X and the same thing happens here. 165
Okay. 166
Until now it's the same. 167
But if we go and we try to do so exposure port 168
let's stop this one and due to exposure bought in the 80s you can see that because I mean the user land 169
I cannot expose report on there the thousand. 170
No right at least because the only route user can expose on the right number and in their full environment. 171
You can see that this is possible. 172
Just like some writers. 173
Yeah that's there's no limitation. 174
Yeah exactly. 175
So it's because as a normal user you cannot go in that kind of portal I mean it's impossible to go over 176
and more or less. 177
That's the differences. 178
And I don't have any more demos for it. 179
I know if you want we can do with some questions or discussion a bit more about the different the route 180
to this mode. 181
Yeah I. 182
There's a there's definite some questions. 183
One of them is about the rootless can't share the darker socket for example so and I I gave a you might 184
want expand on this I kind of gave a an answer saying Well they're different sockets the darker demon 185
that's in root root for mode is isn't a different you are L in the filesystem right it's a different 186
path. 187
So I guess technically you could could you run both of these at the same time. 188
I suppose so. 189
I don't know why you would but you could if you were something you didn't have Docker if you didn't 190
have a root access or Docker group access and you wanted to run Docker on a machine that already had 191
Docker and I guess you I mean all the files and everything around the different paths. 192
Right. 193
So I mean even if you have a say truthful mode I don't care. 194
Running in the viral directory then normally that is for all the users but if you are running it in 195
your own user land then basically just a single user. 196
Right. 197
So you probably you should be able to say that's okay. 198
If you give access to some other users but normally that that's not the case. 199
Yeah yeah. 200
Another question on that is 201
saying that can I use mounts and volumes only with files on my user has permission to. 202
And yes that is true because everything here is scoped to your user account. 203
Right. 204
So it's it's only for you. 205
Yeah. 206
Yeah exactly. 207
So basically what your user can do basically what is what your containers can do yeah. 208
And I mean now technically you could have like you. 209
Since you mean you technically could be someone who has route and you're just choosing to run this in 210
your user account but because the docker demon in this case is running under your user account it's 211
only gonna have access and permissions to the things in there. 212
Yeah. 213
Yeah exactly. 214
See what else. 215
Marcus from yesterday Margo's nose is on the call. 216
He's easy. 217
He has many questions. 218
How about. 219
Does that work. 220
Good question. 221
Mm hmm mm hmm. 222
It should be able to work work I haven't tested it. 223
Yeah. 224
Yeah. 225
So what if you just try to sucker swarm in it in the dark one. 226
Yeah love. 227
Yeah let's see that. 228
And then maybe run do a service create maybe on a you know we're going to rent we're gonna make random 229
demos so it says it's a manager maybe service creates outrage and eggs or something running on port 230
80 80 or something. 231
I mean in theory I would think that it would work because it as long as you don't try to publish on 232
ports one thing might be interesting is will it allow the virtual the vest that it creates. 233
Can it. 234
Oh that's a good point because does Docker Tucker's 235
rootless Docker doesn't have access to create virtual interfaces does it. 236
I don't see why not. 237
I'm trying to think I shouldn't be able to create new return. 238
Yeah. 239
So what happens when you do a list of the networks on there like a or network less on the 240
dance. 241
Yeah it does have them. 242
Mean maybe it's maybe I can't maybe I can't use host mode or something I've remembered reading something 243
about. 244
There was something in networking that it couldn't do without root because that was changing the neck 245
basically. 246
Yeah I remember using host network. 247
Yeah I remember hearing something about that to me. 248
Yeah. 249
What you probably cannot do is for example with because of the limitation of this less than a thousand 250
bought you probably cannot you have a proxy running and doing a balancing between your own services 251
below that so you cannot expose basically a port on the ground that no means or model either. 252
Yeah I don't know. 253
Fingers need something like that. 254
Marcus is asking about demon lists as well as is it possible for us to. 255
Yeah but that's a different thing. 256
I mean this is not demon unless this is ruthless and the basically the difference is that demon. 257
You should not be needing any demon behind that and we don't care. 258
We don't share with anyone else. 259
I think that we could do something with container and the maybe. 260
Right. 261
Yeah. 262
Yeah that's true. 263
I mean I guess fundamentally that would be. 264
I can see how that would be a little tricky because the democracy allied just talks to you. 265
Yeah. 266
Basically a duck or shall I say the way it is being ends in the design is that the client server. 267
So yeah we have a demo. 268
It would almost be like their lead would be there need to be a SEAL I add on that in the background 269
is just really running a docker. 270
The Docker D process but not technically running it as a demon and it's just running into the heart 271
of the docker run. 272
And yeah because you couldn't do that around d d right. 273
You'd have to do it. 274
Okay. 275
Yeah that would be an interesting use case for you actually be for example. 276
So initiation. 277
Basically what you want is you want to be able to create containers. 278
But the problem is that if you share VCA should do that you want to write anything container as well. 279
Then you basically need containers inside the container and then this makes it more complicated. 280
One way of overriding that is basically you can do containers alongside containers. 281
So basically exposing your dog so get inside your container and you can draw more containers inside. 282
But in the same deck and engine and the other thing that you can do is you get on the docket inside 283
the doctor. 284
So basically you can share a demon inside your CIC the container and the other one. 285
Basically this shelter in order to eliminate more of the restriction that the doctor initiated the shares 286
because previously you needed to ship privileges more dating and if you are using user long maybe these 287
people mod is not necessary in order to do shit inside your own container. 288
But having tested that nice either. 289
Yeah. 290
And if you could have demand less then that would simplify a lot. 291
Euros a city in order to not share a demon don't get inside your endocrine system. 292
Lots more questions. 293
I don't actually think that's a question in there about checking binaries or applications inside a container 294
or working perfectly or not. 295
Any Docker features in there. 296
No there are no new features related to that and that's not related to demon lists or rootless Docker 297
rather. 298
There's really Dockers already already has all the features you really need to check binaries or applications 299
for working perfectly. 300
You have Docker logs you have Docker events you have the docker demon logs. 301
You might want to check on my YouTube channel for that because we talked about last week. 302
We actually have sysadmin show we talked all through the different levels of logging and and events 303
and monitoring stuff in Docker so check that out. 304
That's Brett Fisher dot com slash YouTube and then search in there for sysadmin and you can find that 305
question that was a good question though. 306
What from a security perspective. 307
What's the difference between using a rootless containers and user name spaces 308
depending how are you going to create your user name spaces if you need to have root access in order 309
to create them then basically you don't get ruthless. 310
But the question is not where do you run them is how you create them. 311
And basically they're ruthless models that you create your user name spaces below your own user namespace 312
Yeah I mean I guess technically it's funny depending on how technically you want to get I think sweetened 313
rootless containers and user name spaces is that in user name spaces which I'm a big fan of but that 314
the rootless stuff right. 315
That's gonna be. 316
That's gonna be more about only things being in my user and the user name spaces means the docker demons 317
still running root which means I have to have root access I have to build a run Docker as root I have 318
to be in the docker group at least to get access to that and then the user name spaces means that the 319
user running in the container and the container itself are not running under the root process but if 320
there were some like zero day bug and that dog or demon that allowed you to somehow hop into the demon 321
from the container then maybe the username spaces wouldn't help you with that. 322
Maybe I don't know it's from a security perspective. 323
I think you could sit here and debate that all day. 324
Which one's better. 325
I'd say it's more about the use cases right like if this is more about like I don't I don't even want 326
to have anything even possibly being rude. 327
The one thing we don't have in rootless user name spaces by the way for Dr. demon yet which I'm hoping 328
we'll get to someday is where you can run duck or demon then run user name spaces and what that means 329
fundamentally is that every container is running as a non root user but right now they're not different 330
users. 331
So every container running in user name spaces is the same user account and it would be super cool for 332
security if we ran that where every single container you launch was a different user which means they 333
could if someone had a container or exploit they could they couldn't get it contained on a different 334
container. 335
Yeah yeah that was a I think because the user namespace feature was largely written by another doctor 336
captain and Phil Estes who's been on the show talked about that last year actually on username spaces 337
and I kind of asked him like are we going to get to the user in user name spaces user per container 338
thing which they call that like like user name spaces 2.0 and WI and he was like I don't know if anyone 339
is anyone want to build that feature and so it would it would be a cool feature but I don't think it 340
is working out yet. 341
Oh so Marcus is saying swarm acquires loading kernel modules and usually add routes so you can't use 342
overlay I think is one of the limitations overlay requires kernel modules. 343
Maybe the virtual thingy here. 344
Yeah I think overlaying works in the 1. 345
There is plans attacking I think they are thinking about dreaming about but about of their failing systems. 346
Bikers asking if I exist into a rootless container. 347
Is there a password to access route or pseudo de route or is route completely unavailable 348
I think the routes inside the container is basically the a user of the course of the a demon but I think 349
that's awesome. 350
Yeah. 351
So yeah. 352
That's it. 353
I like that answer. 354
That's yeah. 355
If you so if you're in the container and you are the root user in the container you still have no more 356
privileges than what the docker demon's running out on the host which is your user account. 357
So in the container you could. 358
I mean technically you could give route in a container or password. 359
You could make budget users in the container but on the host file system they wouldn't have you know 360
other words because that would be an escalation and privileges beyond what you're allowed to do right. 361
So thank you so much Dmitri. 362
That's really cool stuff that I didn't realize it was that easy to install with the script now that 363
the original post that was put out by the docker team was a little daunting to look at because I like 364
to. 365
This is a this is an hour of my time to get it installed but now that I've got an install script like 366
you have for regular Docker it goes yeah it goes great.