liveBook · Manning

Docker user group

As explained in Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more

The Docker user group is a Unix group whose membership can grant users access to the Docker daemon socket, potentially providing host-root-equivalent control.

The Docker user group is a Unix group whose membership can grant access to the root-owned Docker daemon through /run/docker.sock. Because that daemon can launch processes as root, group membership can provide full root-equivalent control of the host without a password. section 11.1.1 section 1.3.2

# ls -l /run/docker.sock
srw-rw----. 1 root docker 0 Jun 13 14:54 /run/docker.sock

Inspect the socket ownership and group permissions that govern access to the Docker daemon. section 11.1.1

From group access to a host root shell

A user with Docker socket access can run a privileged container, mount the host filesystem, and enter it with chroot: docker run -ti --name hack -v /:/host --privileged registry.access.redhat.com/ubi8-micro chroot /host. Removing the container can also remove evidence when default file logging is used. section 11.1.1 section 1.3.2

Rootless Podman avoids this boundary: container processes run as the invoking user, retain that UID after an escape, and cannot gain capabilities beyond that account. section 1.3.2

How Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more covers it

How deep it goes
Explains group permissions, socket access, privilege escalation, filesystem mounting, chroot, and evidence removal.
Examples
Uses docker.sock permissions and a privileged container mounting / to demonstrate host-root access through chroot.
What it assumes
Assumes basic Unix groups, file permissions, containers, and root privileges while explaining the escalation mechanism concretely.
What you can do after
Evaluate whether Docker group membership grants unacceptable host-root control and compare it with rootless Podman isolation.
How it connects
Connects Docker user-group access with Docker daemon, Unix sockets, privileged containers, rootless containers, and Podman.
Cover of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more
liveBookmanning.com
Read Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more. The section links point to the parts of the book it draws on.