A cgroup is a Linux kernel mechanism that organizes processes into hierarchical groups whose resource usage can be limited and monitored. Containers use cgroups to stop one process group from dominating the system and preventing other workloads from making progress. section 1.2
Cgroups can constrain or account for resources such as:
- Memory available to a group of processes. section 1.2
- CPU available to the processes. section 1.2
- Network resources available to a process group. section 1.2
- Shared resource boundaries for containers in a pod. section 1.1
Cgroups provide resource isolation rather than the complete container security boundary. Containers also rely on capabilities, SELinux, read-only kernel filesystems, seccomp, and user namespaces to restrict privilege and access. section 1.2
Podman services under systemd
Systemd places every process belonging to a service unit into the same cgroup hierarchy and uses the PID cgroup to track and manage the service. Podman’s process model lets systemd manage a containerized service’s processes, cgroups, and lifespan. section 7.0 section 1.3.7
Table 1.1 Advanced Linux security features (view table figure)
| Linux capabilities subdivide the power of root into distinct capabilities. |
The capabilities man page is a good overview of the available capabilities (https://bit.ly/3A3Ppeg). |
|
| Security-Enhanced Linux (SELinux) is a Linux kernel mechanism that labels every process and every filesystem object on the system. A SELinux policy defines the rules on how labeled processes interact with label objects. The Linux kernel enforces the rules. |
I wrote the SELinux Coloring Book, which is a fun way to help you understand SELinux (https://bit.ly/33plEbD). If you really want to study the subject, check out the SELinux notebook (https://bit.ly/3GxGhkm). |
|
| seccomp is a Linux kernel mechanism that limits the number of syscalls to a group of processes on the system. You can remove potentially dangerous syscalls from being called by the processes. |
The seccomp man page is a good source of additional information on seccomp (https://bit.ly/3rnnim1). |
|
| The user namespace allows you to have Linux capabilities within the group of UIDs and GIDs assigned to the namespace, without having root capabilities on the host. |
Compare cgroup-based resource constraints with the Linux capabilities, SELinux, and seccomp mechanisms that complete the container isolation model. section 1.2
