The root user is the privileged Unix-like operating-system account with authority to modify core host resources. Rootful container execution runs through this privileged boundary; rootless execution keeps container processes under the ordinary user’s UID. section 6.0 section 1.3.2
Giving users access to a root-owned container daemon can effectively grant host-root access. A privileged container with the host filesystem mounted can enter the host installation with chroot, while rootless Podman limits processes to the user’s permissions. section 11.1.1 section 1.3.2
The root boundary matters because:
- A root-running daemon can let any authorized daemon client launch fully privileged host processes. section 6.0
- Rootless Podman runs workloads independently under each user account, without granting container processes capabilities beyond a normal user. section 1.3.2
- Audit logs can preserve evidence of activity that removing a container or file-based logs might otherwise conceal. section 11.1.1
From container access to a host root shell
A Docker client with daemon access can run `docker run -ti --name hacker --privileged -v /:/host ubi8 chroot /host`, mounting the host filesystem and entering it as root. Removing the container does not change the privilege exposure.
Figure 6.1 Multiple users’ workloads sharing the same daemon running as root is inherently insecure.
Compare the security boundary of multiple workloads sharing one root-running daemon with independent workloads running in separate user spaces. section 6.0
