What are the potential security problems running untrusted code in a Docker container as a non-root user?

Question

I\'ve seen plenty of ink spilled by now about how Docker is not sufficiently isolated to allow arbitrary containers to be run in a multi-tenant environment, and that makes s

Answer 1

All containers share the same kernel. In case your un-trusted code manages to perform a kernel exploit, it can do whatever it wants on the host and/or any other running container.

Answer 2

As of Docker v1.12, if one runs a container as a non-root user with user namespaces enabled, there are two levels of privilege escalation a malicious actor needs to perform in order to become root on host:

1. Escalate from non-root to root user inside container
2. Escalate to root user in container to root user on the host

So in case untrusted code is run inside a Docker container as non-root user, it will be slightly more difficult for an attacker to become root on host, since we add an extra step of becoming root inside container. That's the only advantage in terms of security compared to running containers with root privileges.

In case of privilege escalation through both layers of security, following should help restrict the attack surface:

1. Workloads(more specifically docker containers, in this context) with different trust levels should be isolated from each other by use of overlay networks following least privilege principle.
2. Enabling available Linux security module in enforcement mode(e.g. SELinux, AppArmor)

References:

• Running with non-root privileges inside containers: https://groups.google.com/forum/#!msg/docker-user/e9RkC4y-21E/JOZF8H-PfYsJ
• Overlay networks: https://docs.docker.com/engine/userguide/networking/get-started-overlay/
• User namespaces: https://docs.docker.com/engine/security/security/#/other-kernel-security-features