liveBook · Manning

Kernel filesystem

As explained in Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more

A kernel filesystem is a filesystem interface exposed by the operating-system kernel for representing kernel-managed information or resources.

A kernel filesystem is a kernel-provided interface, commonly mounted under /proc or /sys, that exposes information or controls for kernel-managed resources. Containers generally need to read these filesystems, but unrestricted writes could compromise the host. Podman therefore limits, masks, or mounts selected kernel filesystems read-only. section 10.1 section 1.2

Podman applies several boundaries to kernel filesystem access:

  • Mounts /sys, /sys/fs/cgroup, and /sys/fs/selinux read-only while providing a namespaced /proc inside the container. section 10.1
  • Masks sensitive paths such as /proc/kcore, /proc/keys, /proc/sys, and /sys/firmware with read-only temporary or bind mounts. section 10.1
  • Combines filesystem restrictions with mount namespaces, SELinux, capabilities, seccomp, and user namespaces rather than defaulting to --privileged. section 10.0 section 1.2

Container access boundary

A process inside a PID namespace sees the container’s /proc rather than the host’s /proc and can affect only processes within that namespace. An application needing a masked directory may require carefully scoped additional access. section 10.1

Table 10.2 Filesystem fields masked over with Podman (view table figure)

Type of masking

Paths

Read-only tmpfs mounted over the directory

/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/timer_list, /proc/timer_stats, /proc/sched_debug, /proc/scsi, /sys/firmware, /sys/fs/selinux, /sys/dev/block

Read-only bind mount over the directory

/proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger

Browse the complete list of filesystem paths Podman masks and the mount treatment applied to each. section 10.1

How Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more covers it

How deep it goes
Explains /proc and /sys mounts, namespaces, read-only treatment, and masking, but stops short of detailed configuration procedures.
Examples
Uses /proc, /sys, /sys/fs/cgroup, /sys/fs/selinux, and Podman-masked paths such as /proc/kcore and /sys/firmware.
What it assumes
Assumes familiarity with Linux processes, filesystems, and administrator privileges while defining container isolation mechanisms.
What you can do after
Evaluate container access failures and avoid using --privileged as the first response to denied kernel filesystem access.
How it connects
Connects kernel filesystems with mount namespaces, PID namespaces, SELinux, Linux capabilities, seccomp, user namespaces, and cgroups.
Cover of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more
liveBookmanning.com
Read Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more. The section links point to the parts of the book it draws on.