base: Make -debian10 images default to nonroot user#414
base: Make -debian10 images default to nonroot user#414evanj wants to merge 1 commit intoGoogleContainerTools:masterfrom evanj:debian10-nonroot-default
Conversation
Running as a non-root user inside a container provides some additional security. For example, the runc container escape would not work for non-root users: https://aws.amazon.com/blogs/compute/anatomy-of-cve-2019-5736-a-runc-container-escape/ The existing Distroless images need to default to a root user for compatibility. However, the introduction of -debian10 images gives us an opportunity to break backwards compatibility, since users will need to opt-in to the update anyway.
|
I recognize that this is a potentially controversial change, so it could make sense to reject it. This fixes #374 |
|
Any chance we can get on a call tomorrow to talk me through this change? |
|
Sure; I'm also not attached to this change and am happy to walk away from it. This just came up in discussion on #368; Since the debian10 switch somewhat breaks compatibility anyway, I figured this would be a good chance to introduce this sort of change if we want do. Email me at evan.jones@bluecore.com if you want to arrange a call? |
|
@evanj not making any meaningful point, but I've read the doc you linked for my own curiosity, and my understanding is that the vulnerability can still be exploited when running an image as non-root inside the container, since |
|
Upon further review: it appears you may be correct! I am far from an expert in this stuff. I just know that a lot of the "best practices" guides suggest setting a non-root user. If that really is "best practice" then we should make that easy? E.g. https://www.weave.works/blog/kubernetes-best-practices and Google's guide https://cloud.google.com/solutions/best-practices-for-operating-containers#avoid_running_as_root My understanding is that distroless added the |
|
I personally would like to see Distroless switch to use
|
|
+1 to this initiative! Any updates on consensus to this, from k8s community as well as here? |
|
@chanseokoh Knative is good - we use nonroot images already :) |
|
I think running nonroot by default makes sense. |
|
@evanj I believe for all of Istio's distroless-based images, non-root defaults should be fine. The images in which we run as root, require root, and are not based upon distroless at this time. Where we face a challenge: Istio's sidecar injection requires root privileges for some parts of the sidecar. We are moving our injection to CNI - such that root on the host is required to run iptables, rather than root within the container. This model is expensive to implement, but for serious projects, a really sound technical approach. Please see: istio/istio#24815 (comment) for more details on one of many of the pieces of work that need to complete in Istio to support nonroot defaults. But please, don't let us stop you or slow you down, I, personally, want to see this change happen and think its a great change. Cheers, |
Fixes #374.
Running as a non-root user inside a container provides some additional
security. For example, the runc container escape would not work for
non-root users:
https://aws.amazon.com/blogs/compute/anatomy-of-cve-2019-5736-a-runc-container-escape/
The existing Distroless images need to default to a root user for
compatibility. However, the introduction of -debian10 images gives us
an opportunity to break backwards compatibility, since users will need
to opt-in to the update anyway.