A container escape vulnerability is a flaw in Linux containerization that lets a process cross its sandbox and gain access to the node. Because containers are host processes isolated with cgroups and namespaces, the escaped process inherits the privileges of its container user: a root container could expose full root access on the node. section 12.4 section 12.7.2
Reduce the consequences of an escape with layered defenses:
- Run containers as non-root users so an escape does not immediately provide elevated node privileges. section 12.4
- Use Pod Security admission to limit container access, then add a secure runtime when container isolation alone is insufficient. section 12.7.2
- Configure RuntimeClass with an additional sandbox such as gVisor when running untrusted code, accepting a performance penalty. section 12.7.2
Making a timeserver compatible with non-root execution
Set runAsNonRoot to true. If the image still defaults to root, Kubernetes reports CreateContainerConfigError; define USER 1001 in the Dockerfile and runAsUser: 1001 in the Pod. Because non-root processes cannot bind port 80, change the server to port 8080 and target that port from the Service. Adjust log-directory permissions so the application can write its logs. section 12.4
Listing 12.6 Chapter12/12.4_NonRootContainers/1_permission_error/deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: timeserver
spec:
replicas: 1
selector:
matchLabels:
pod: timeserver-pod
template:
metadata:
labels:
pod: timeserver-pod
spec:
containers:
- name: timeserver-container
image: docker.io/wdenniss/timeserver:6
securityContext: #1
runAsNonRoot: true #1
#1 Prevent running this container as the root user.
Inspect the Kubernetes Deployment fragment that prevents the container from running as root. section 12.4
