![](\"https:\/\/demensdeum.com\/blog\/wp-content\/uploads\/2025\/03\/mediadocker-rootless.png\")
<\/p>\nDocker has become an indispensable tool in modern Devops and development. It allows you to isolate the encirclement, simplify the outfit and quickly scale applications. However, by default, Docker requires a ROOT, and this creates a potentially dangerous zone, which is often ignored in the early stages.<\/p>\n
Docker uses the capabilities of the Linux: Cgroups, Namespaces, Iptables, Mount, Networking and other system functions. These operations are available only to the super -user.<\/p>\n
That’s why:
\n* Dockerd demon starts from Root,
\n* Docker commands are transmitted to this demon.<\/p>\n
This simplifies the work and gives full control over the system, but at the same time it opens up potential vulnerabilities.<\/p>\n
With weak insulation, an attacker can use Chroot or Pivot_root to enter the host.<\/p>\n
Examples of real attacks:<\/p>\n
* CVE-2019-5736-vulnerability to RUNC, allowed to rewrite the application and execute the code on the host.
\n* CVE-2021-3156-vulnerability to SUDO, allowed to get a ROOT inside the container and get out.<\/p>\n
If the application in the container is vulnerable and starts from Root, RCE = full control over the host.<\/p>\n
<\/p>\n
To minimize these risks, Rootless mode appeared in Docker. In this mode, both the demon and the containers are launched on behalf of the usual user, without any Root-privilegies. This means that even if an attacker receives control over the container, he will not be able to harm the host system.
\nThere are restrictions: you can not use ports below 1024 (for example, 80 and 443), the –privileged mode, as well as some network modes, is not available. However, in most development scenarios and CI\/CD Rootless Docker, it copes with its task and significantly increases the level of security.<\/p>\n
From the very beginning, the principle of the smallest privileges has been applied in the Unix\/Linux world. The fewer rights the process, the less harm it can do. Docker initially demanded a Root access, but today it is considered a potential threat.<\/p>\n
https:\/\/docs.docker.com\/engine\/security\/rootless\/<\/a> Docker has become an indispensable tool in modern Devops and development. It allows you to isolate the encirclement, simplify the outfit and quickly scale applications. However, by default, Docker requires a ROOT, and this creates a potentially dangerous zone, which is often ignored in the early stages. Why does Docker work from Root? Docker usesContinue reading “Docker safety: Why is the launch of Root is a bad idea”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[49],"tags":[],"class_list":["post-4147","post","type-post","status-publish","format-standard","hentry","category-blog","entry"],"translation":{"provider":"WPGlobus","version":"3.0.2","language":"en","enabled_languages":["en","ru","zh","de","fr","ja","pt","hi"],"languages":{"en":{"title":true,"content":true,"excerpt":false},"ru":{"title":true,"content":true,"excerpt":false},"zh":{"title":true,"content":true,"excerpt":false},"de":{"title":true,"content":true,"excerpt":false},"fr":{"title":true,"content":true,"excerpt":false},"ja":{"title":true,"content":true,"excerpt":false},"pt":{"title":true,"content":true,"excerpt":false},"hi":{"title":false,"content":false,"excerpt":false}}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/posts\/4147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/comments?post=4147"}],"version-history":[{"count":6,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/posts\/4147\/revisions"}],"predecessor-version":[{"id":4153,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/posts\/4147\/revisions\/4153"}],"wp:attachment":[{"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/media?parent=4147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/categories?post=4147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/demensdeum.com\/blog\/wp-json\/wp\/v2\/tags?post=4147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nhttps:\/\/rootlesscontaine.rs\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"