A Linux namespace is a kernel isolation mechanism that creates a virtualized environment where processes see selected resources while remaining separated from the host and other containers. section 1.2
Container isolation commonly combines several namespace types:
- Network namespaces hide the host network while exposing virtual network devices. section 1.2
- Mount namespaces hide the host filesystem and expose the container filesystem. section 1.2 section 10.0
- PID namespaces hide host processes so container processes see processes within their container. section 1.2 section 10.0
- IPC and user namespaces further separate operating-system resources and map container root to a limited host identity. section 10.0 section 1.2
Namespaces provide a virtual-machine-like view without virtual-machine overhead, but they are one layer of container security. Podman also relies on cgroups, dropped capabilities, SELinux, seccomp, and protected kernel filesystems. section 1.2 section 10.0
Avoiding privileged mode
When a container is denied access, diagnosing the relevant namespace or security boundary is safer than immediately using --privileged, which turns off all security separation. section 10.0
Table 1.1 Advanced Linux security features (view table figure)
| Linux capabilities subdivide the power of root into distinct capabilities. |
The capabilities man page is a good overview of the available capabilities (https://bit.ly/3A3Ppeg). |
|
| Security-Enhanced Linux (SELinux) is a Linux kernel mechanism that labels every process and every filesystem object on the system. A SELinux policy defines the rules on how labeled processes interact with label objects. The Linux kernel enforces the rules. |
I wrote the SELinux Coloring Book, which is a fun way to help you understand SELinux (https://bit.ly/33plEbD). If you really want to study the subject, check out the SELinux notebook (https://bit.ly/3GxGhkm). |
|
| seccomp is a Linux kernel mechanism that limits the number of syscalls to a group of processes on the system. You can remove potentially dangerous syscalls from being called by the processes. |
The seccomp man page is a good source of additional information on seccomp (https://bit.ly/3rnnim1). |
|
| The user namespace allows you to have Linux capabilities within the group of UIDs and GIDs assigned to the namespace, without having root capabilities on the host. |
Review the related Linux security mechanisms that complement namespace isolation, including capabilities, SELinux, and seccomp. section 1.2
