undefined | Better HN

0 pointsheywoodlh2y ago0 comments

https://docs.docker.com/desktop/mac/permission-requirements/

This link breaks down what permissions are used on MacOS.

> Maybe I’m using the wrong term

Typically, the meaningful piece with "rootless" Docker is that the daemon is not running as root.

When the Docker daemon is running as root on a Linux server, for example, anyone who can access the daemon (i.e. anyone in the "docker" group) has enough access to the system can do catastrophic damage with the access they have. For example, the docker daemon can mount any file on the host's filesystem (i.e. "-v /etc/shadow:/tmp/shadow"). With Docker running as root, anyone with access to the Docker daemon has the power to do almost anything to the system.

With rootless Docker, that issue is mitigated heavily because the Docker context is restricted to an unprivileged user context.

> but when installing Docker, you need root access, and not for Podman

According to Podman Desktop's docs, it asks for admin permission when installing on MacOS: https://podman-desktop.io/docs/Installation/macos-install

That being said, I don't personally see any security value added or removed by an installer process needing to elevate privileges. That's a one-time thing and likely should require admin privileges.

0 comments

thiht2y ago

> That being said, I don't personally see any security value added or removed by an installer process needing to elevate privileges. That's a one-time thing and likely should require admin privileges

Where I worked before we didn’t have root access on our laptops, so we couldn’t install Docker.

I’ve switched company since, but my former coworkers were able to install Podman (not Podman Desktop) without root access.

heywoodlhOP2y ago

Ah, I see. So not really container runtime security, more operational/principle of least privilege. Had not accounted for that, I can definitely see how that would be useful.

Although, I would say we have definitely strayed far away from the typical definition/security benefits of "rootless" container runtimes. Usually the rootless container threat model accounts for containers or access to the runtime being weaponized -- it's not usually IT preventing you from installing apps. :)

Still, thanks for indulging this conversation.

(Also, I thought the only way to run Podman containers locally on MacOS was Podman Desktop -- has that changed recently?)

j / k navigate · click thread line to collapse