guys pls help i self-host a handful of apps in containers. Most of the images i use run as root inside teh container by default. i keep reading that this is a bad practice, but also that containers provide isolation anyway.
For a home or small-business setup, do ppl actually bother running containers as non-root or using rootless mode?? xD What other hardening steps give teh most benefit for little effort?? seriously need help here 😭
yeahhh about eight contaienrs. most run as root by default. updates are manual whenever i remember. none of them have any of the hardening options set.
A cheap set of defaults in compose that work for many apps:
user: "1000:1000"
read_only: true
cap_drop: [ALL]
security_opt:
- no-new-privileges:true
tmpfs:
- /tmp
not every image tolerates all of these... add them one at a time and check the logs.
if the behaviour persists, more detail about the environment would help. good luck man!
from experience: non-root inside teh container is the one Id always do when the image supports it, containers share teh host kernel, so if an app is compromised and theres a container escape bug, root inside means a much better starting point for teh attacker... many images support a user: setting or a documented UID/GID environment variable. hope that helps :)
hmmm honestly, the biggest wins are boring: keep images updated, dont expose admin interfaces directly to teh internet, and never mount the Docker socket into a container unless you understand that it effectively grants root on the host. that last one shows up in a lot of example compose files for dashboards and auto-updtaers. hope that helps :)
tbh im still pretty skeptical about how much security we actually get from non-root if the underlying image is just poorly built. but if u want to actually harden things without breaking every single app, u should look into seccomp profiles. most people forget about those because they're a pain to configure manually, but they restrcit the sysetm calls the container can make to the kernel.
also, check if your storage drivers are actually isolating the filesystem enough.. 😅 if u're using some weird overlay setup or old drivers, that's a bigger risk than just running as root. for a home lab, i'd prioritize keeping the host OS patched and using a firewall to block everything except the specific ports u need. honestly, just not exposing teh management UI of ur apps to the public web is 90% of the battle. don't overcomplicate it until u actually have a reason to. fingers crossed 🤞
Sign in or create an account to reply.
