{"id":28183965,"url":"https://github.com/ad-freiburg/docker-no-trivial-root","last_synced_at":"2025-05-16T05:12:24.328Z","repository":{"id":57572071,"uuid":"119067337","full_name":"ad-freiburg/docker-no-trivial-root","owner":"ad-freiburg","description":"Very experimental docker authorization plugin, disabling some trivial ways of gaining root via docker","archived":false,"fork":false,"pushed_at":"2018-05-24T12:22:10.000Z","size":20,"stargazers_count":11,"open_issues_count":0,"forks_count":6,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-04T20:41:09.334Z","etag":null,"topics":["docker","experimental","user-namespaces"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ad-freiburg.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-01-26T15:20:22.000Z","updated_at":"2023-05-12T07:51:40.000Z","dependencies_parsed_at":"2022-08-24T03:11:13.984Z","dependency_job_id":null,"html_url":"https://github.com/ad-freiburg/docker-no-trivial-root","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ad-freiburg%2Fdocker-no-trivial-root","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ad-freiburg%2Fdocker-no-trivial-root/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ad-freiburg%2Fdocker-no-trivial-root/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ad-freiburg%2Fdocker-no-trivial-root/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ad-freiburg","download_url":"https://codeload.github.com/ad-freiburg/docker-no-trivial-root/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254470987,"owners_count":22076587,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","experimental","user-namespaces"],"created_at":"2025-05-16T05:11:49.419Z","updated_at":"2025-05-16T05:12:24.322Z","avatar_url":"https://github.com/ad-freiburg.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"No Trivial Root for Docker\n==========================\n\n**WARNING THIS IS VERY EXPERIMENTAL WITH NO CLAIM OF ACTUAL SECURITY**\n\nThis is a very minimal [docker authorization\nplugin](https://docs.docker.com/engine/extend/plugins_authorization/) designed\nto prevent trivial root escalation on docker already **running with user\nnamespaces**.\n\nTo be absolutely clear *without user namespaces this plugin is useless*. This\nis because without the activation of user namespaces `root` in a container is\nalways the same user as `root` outside the container and thus the trivial root\ncase below works even without additional parameters.\n\nOne example of such a trivial way of gaining root would be\n\n    docker run --userns=host --rm -it -v /:/root/ busybox\n    / # echo \"Written by root\" \u003e /root/i_can_write_as_root.txt\n    / # exit\n    ls -la / # /i_can_write_as_root.txt is owned by root\n\n**Explanation:** In this container the host's `/` is mounted at `/root/` and\nsince the host and the container share a user namespace (`--userns=host`) the\nroot user within the container can write files on the host as root (including\nsetting setuid bits). The user is thus effectively root.\n\nBuild/Download\n--------------\nMake sure you have a Go environment [set up](https://golang.org/doc/install)\nthen do\n\n    go get github.com/ad-freiburg/docker-no-trivial-root\n\nAlternatively you can download binary releases\n[here](https://github.com/ad-freiburg/docker-no-trivial-root/releases)\n\nSetup\n-----\nAgain **make sure** you have [user namespaces enabled](https://docs.docker.com/engine/security/userns-remap/)\n\nCreate a startup unit for your init system of choice and make sure\n`docker-no-trivial-root` is launched as root on startup\n\nFor systemd (most distributions) this can be done with the following steps\n\n    # For a build from source\n    sudo cp $GOPATH/bin/docker-no-trivial-root /usr/sbin\n    sudo cp $GOPATH/src/github.com/ad-freiburg/docker-no-trivial-root/systemd/docker-no-trivial-root.service /lib/systemd/system/\n\n    # Or for a binary release\n    cd /tmp # necessary if your $HOME is not readable with sudo (because of NFS)\n    wget https://github.com/ad-freiburg/docker-no-trivial-root/releases/download/v0.1.0/docker-no-trivial-root_$(uname -m).tar.bz2\n    tar -xavf docker-no-trivial-root_$(uname -m).tar.bz2\n    cd docker-no-trivial-root_$(uname -m)/\n    sudo cp docker-no-trivial-root /usr/sbin/docker-no-trivial-root\n    sudo cp systemd/docker-no-trivial-root.service /lib/systemd/system/\n\n    sudo systemctl enable docker-no-trivial-root.service\n    sudo systemctl start docker-no-trivial-root.service\n\n**Enable** the plugin by adding `--authorization-plugin=no-trivial-root` to\nyour dockerd command line.  On Ubuntu this is an `ExecStart` in\n`/lib/systemd/system/docker.service`\n\n    sudo systemctl edit --full docker.service\n    sudo systemctl daemon-reload\n    sudo systemctl restart docker.service\n\n\nTest It\n-------\nThe following command should give an error message saying that `--userns=host`\nis not allowed\n\n    docker run --userns=host --rm -it -v /:/root/ busybox\n\nalso you should get permission denied running `touch /root/foo` inside the container\ncreated by the following command\n\n    docker run --rm -it -v /:/root/ busybox\n\nWhat's Prevented\n--------------------------\nThis authorization plugin currently prevents the following `docker run`\nparameters\n\n- `--userns=host`\n- `--uts=host`\n- `--pid=host`\n- `--net=host`\n- `--log-driver`\n- `--log-opt`\n- `--cap-add`\n- `--device`\n- `--security-opt`\n- `--privileged`\n\nConfiguration\n-------------\nAt this time there is absolutely no configuration, if you want to block\nanything more than it currently does you must change the code.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fad-freiburg%2Fdocker-no-trivial-root","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fad-freiburg%2Fdocker-no-trivial-root","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fad-freiburg%2Fdocker-no-trivial-root/lists"}