‫Left over on your screen is Dmitri.
‫I think this is your first time on the show right.
‫Yeah.
‫All right.
‫This is the first time on.
‫So thanks for having me.
‫Yeah.
‫And he's right now in Greece but he's actually normally in Barcelona running the darker Barcelona meetup.
‫He is the founder at Harbor cloud solutions and I'm super excited him on the show because he's going
‫to talk to us about rootless Docker which is a brand new thing this year and we'll talk about why that's
‫important and why you might want to check it out.
‫Dimitri what's the elevator pitch to someone who knows containers and they know how to run Docker now
‫why should they care about rootless Docker.
‫Yeah so basically.
‫First of all why do we need containers in the first place.
‫Basically what we want to do with containers is that we want to isolate the applications inside their
‫specific user space so that they can not do things outside of that space and isolate them.
‫And in that context.
‫But once someone once is able to run containers what we know is that if normally what we say if you
‫have access to the doctors socket then basically you are out of the application of of the operating
‫system.
‫And basically this means that if someone can access the doctor so I can then choose a route on the on
‫the operating system and we don't want that.
‫You basically want someone to be able to have isolated thought and not being able to do these kinds
‫of things and write with them with the story with a bat basically with truth that is what we can say
‫we are able to do is that.
‫Am sorry.
‫Hang.
‫Yeah.
‫I would like a severe brain freeze right now.
‫No that's okay.
‫So yeah basically with rootkit is what we have is the ability in order to run containers but not with
‫toxicity that the operating system so someone can not on some containers without being rude.
‫So if someone breaks out of that container then he cannot access the operating system let's say so.
‫Right.
‫Basically what you do is is duplicate some kind of X and another layer of security on top of the containers.
‫Right.
‫So this means that also if I want to run a docker container if I'm running in ruthless mode does that
‫mean I don't even need route I can just be a regular user.
‫Yeah exactly.
‫So basically if you you don't need the ruby in order to be able to install Docker in some machine and
‫you can use Dr. Oz as a normal user of that that specific machine and you can create containers as if
‫you are a route but and create some users some some containers.
‫But you don't need to access that specific machine.
‫Yeah.
‫So basically there are two kinds of benefits in two different regions Jane two different type of users
‫let's say ones are the users that there are developers maybe they don't share the route accessing that
‫specific machine that they are working on and now with the characters they can install the doctor without
‫giving route access and they can use that in order to put on containers in their own environment and
‫the other one is if you are an operator or a if you're using that if you have a class there for example
‫that you want to kind of in your own cluster and you don't go to run containers using a doctor in route
‫mode but you want to use it being in a user long thing in a specific user so that even if someone breaks
‫out of that specific container then you cannot access the route to that specific machine.
‫So you have a basically.
‫And one more layer of security contact specially from the scene right.
‫And basically that's that's the idea and you say you should have some kind of restrictions.
‫But we're going to see that on the demo.
‫But basically you can do whatever you can do normally with containers.
‫Yeah well let's go.
‫Let's do it let's get to some demos.
‫I think sometimes it's great to talk about something but it's also cool to see.
‫Let's go to the demo there.
‫OK.
‫So basically what we have here is you've created a spaceship.
‫My machine is a Mac so I can there.
‫So the doctor ruthless in my max because basically we want to have a Linux kernel on it.
‫And so what I'm using is I'm using a vagrant and virtual box in order to run virtual machines and virtual
‫boxes a virtual machine runtime and what kind is it.
‫Basically a provider for which all machines in my in vitro box.
‫And this is basically my configuration.
‫I have two specific machines that I'm creating.
‫One is a ruthless which is born two of the Sanyo version 64 and the other is four basically.
‫So what we want these ruthless is I'm going to do an installation of in the ruthless mode in the road
‫for.
‫Basically I'm going to do a normal installation of Docker and I shave them already running
‫and there's tattoos.
‫You'll see that these machines are running
‫once.
‫Okay so on the touch screen I'm going to log into a ruthless machine and the bottom screen I'm going
‫to say it's too little too late.
‫I like rueful Yeah I don't know if it's written like that but that's sounds.
‫We just made up a new word rueful that wasn't a thing it's now a thing.
‫OK.
‫So how are we going to install ruthless mode here.
‫So I'm just going to show you what are the commands for it.
‫And then I have a script which is the set up here which basically what I the only thing that they need
‫in order to prepare the operating system the Born to send young 64 version is I want to activate the
‫IP tables in the cabinet.
‫I want to have that then basically what I want to do is I want to install Docker with these these command.
‫Basically this is a script that said yeah let's call ruthless.
‫And normally you should not accept scripts from the Internet like and like that.
‫But let's say that we would know the audience in Okay it's.
‫We are at least SSL over to Dockers you are ell so it would have to require someone to take advantage
‫of that.
‫But you can always always pull it down.
‫Exactly.
‫You can not pull it down.
‫If you eat and then execute it right.
‫Yeah.
‫So I already executed in the start before so it basically knows that I already installed it.
‫But if you're in the first machine with this should be sufficient in order to install the ruthless mode
‫and what their Kozmo does is create their service in the System D which basically runs inside your home
‫directory.
‫So you see this is the other service inside my home background which is my user name and in that machine
‫and there is there where the the system the service is installed.
‫And if you see the binary for example use these the background being the the ruthless in experimental
‫mode and these terms that I was overlay and once I have these installed if I like it appears it will
‫not do anything because I don't show having device on the [REMOVED] it I don't ever run into anything there
‫because my socket right now is inside this user space in the wrong user a thousand Docker socket.
‫So I need to export these Docker host and now had the bigger Piers then you can see that I can I can
‫use that can I get a ticket if I do care for the world for example you can see that now I can run things
‫inside the container and there appears for example and don't have anything.
‫And see here you can see that the containers that already run in the full environment that do the same
‫thing here.
‫And in order to install it they're basically the command is this one and it's the get Docker and then
‫you download the script you execute it and once you execute it
‫and you have everything but I already have it installed so I'm just going to stop it now.
‫And once you have it installed then you can see a doctor is running.
‫So let's see now what are the difference between these two environments.
‫If I do a B.S. here and speak about the care you will see that my doctor is running US route and it's
‫running in these with these command instead and here if I said for a doctor you will see that there
‫are some other commands that because it's using brutalist kit and if you see all of those commands running
‫in user background.
‫So there is no road user are running anything.
‫And that's that's basically the biggest difference between those two and so let's try and run the same
‫commands on both machines that you're on.
‫Hello world.
‫You will see that this runs the same thing and let's see some other things that we can run at.
‫First of all I would like to say some one.
‫One other difference a if you are in the
‫in the road for my scene here right now you can see that Dr. Pierce is running directly but this is
‫because if we're taking the groups you can see that.
‫I have the doctor group here.
‫And if I go and log in as I think there's another bone to use here and if I do that Europeans I cannot
‫do anything with the socket.
‫And this is because I don't belong to the doctor group.
‫So this is one of the difference that if you belong to the doctor group then basically you have access
‫to the doctor socket.
‫And if you don't belong to the group then basically you need to do a show to do that.
‫Yes.
‫And this is one way of accessing the socket in the wrathful machine and another and other ways to use
‫the group.
‫And the big difference here on the ruthless is that you don't need both neither of those.
‫You don't need to have and so do to some kind of socket that belongs to another user.
‫You just ran it in your own user space everything and.
‫OK so let's see some other commands for example the two were eyes.
‫Things that are running inside the room full.
‫If we took to the virally the clear overlay this is where our overlays are running inside the edit for
‫the environment but if we check the same thing here you will see that they don't have anything there.
‫And this is because everything is running in our own user space.
‫And I can find these things in this directory which is the local Sir Doctor.
‫And then here you can see the overlay that occurs and you can see that these are inside the same user
‫patient.
‫My own user.
‫So in our defense that we can find for example use that.
‫Let's run something now.
‫She's exposing a board.
‫So I am running an engine X and I'm running it and exposing it in the thirty two thousand seven hundred
‫sixty eight port and then went into the same --.
‫So
‫yeah that's something like this
‫okay.
‫So if I don't know.
‫Okay.
‫Now I'm sure you can see the ends in X and the same thing happens here.
‫Okay.
‫Until now it's the same.
‫But if we go and we try to do so exposure port
‫let's stop this one and due to exposure bought in the 80s you can see that because I mean the user land
‫I cannot expose report on there the thousand.
‫No right at least because the only route user can expose on the right number and in their full environment.
‫You can see that this is possible.
‫Just like some writers.
‫Yeah that's there's no limitation.
‫Yeah exactly.
‫So it's because as a normal user you cannot go in that kind of portal I mean it's impossible to go over
‫and more or less.
‫That's the differences.
‫And I don't have any more demos for it.
‫I know if you want we can do with some questions or discussion a bit more about the different the route
‫to this mode.
‫Yeah I.
‫There's a there's definite some questions.
‫One of them is about the rootless can't share the darker socket for example so and I I gave a you might
‫want expand on this I kind of gave a an answer saying Well they're different sockets the darker demon
‫that's in root root for mode is isn't a different you are L in the filesystem right it's a different
‫path.
‫So I guess technically you could could you run both of these at the same time.
‫I suppose so.
‫I don't know why you would but you could if you were something you didn't have Docker if you didn't
‫have a root access or Docker group access and you wanted to run Docker on a machine that already had
‫Docker and I guess you I mean all the files and everything around the different paths.
‫Right.
‫So I mean even if you have a say truthful mode I don't care.
‫Running in the viral directory then normally that is for all the users but if you are running it in
‫your own user land then basically just a single user.
‫Right.
‫So you probably you should be able to say that's okay.
‫If you give access to some other users but normally that that's not the case.
‫Yeah yeah.
‫Another question on that is
‫saying that can I use mounts and volumes only with files on my user has permission to.
‫And yes that is true because everything here is scoped to your user account.
‫Right.
‫So it's it's only for you.
‫Yeah.
‫Yeah exactly.
‫So basically what your user can do basically what is what your containers can do yeah.
‫And I mean now technically you could have like you.
‫Since you mean you technically could be someone who has route and you're just choosing to run this in
‫your user account but because the docker demon in this case is running under your user account it's
‫only gonna have access and permissions to the things in there.
‫Yeah.
‫Yeah exactly.
‫See what else.
‫Marcus from yesterday Margo's nose is on the call.
‫He's easy.
‫He has many questions.
‫How about.
‫Does that work.
‫Good question.
‫Mm hmm mm hmm.
‫It should be able to work work I haven't tested it.
‫Yeah.
‫So what if you just try to sucker swarm in it in the dark one.
‫Yeah love.
‫Yeah let's see that.
‫And then maybe run do a service create maybe on a you know we're going to rent we're gonna make random
‫demos so it says it's a manager maybe service creates outrage and eggs or something running on port
‫80 80 or something.
‫I mean in theory I would think that it would work because it as long as you don't try to publish on
‫ports one thing might be interesting is will it allow the virtual the vest that it creates.
‫Can it.
‫Oh that's a good point because does Docker Tucker's
‫rootless Docker doesn't have access to create virtual interfaces does it.
‫I don't see why not.
‫I'm trying to think I shouldn't be able to create new return.
‫Yeah.
‫So what happens when you do a list of the networks on there like a or network less on the
‫dance.
‫Yeah it does have them.
‫Mean maybe it's maybe I can't maybe I can't use host mode or something I've remembered reading something
‫about.
‫There was something in networking that it couldn't do without root because that was changing the neck
‫basically.
‫Yeah I remember using host network.
‫Yeah I remember hearing something about that to me.
‫Yeah.
‫What you probably cannot do is for example with because of the limitation of this less than a thousand
‫bought you probably cannot you have a proxy running and doing a balancing between your own services
‫below that so you cannot expose basically a port on the ground that no means or model either.
‫Yeah I don't know.
‫Fingers need something like that.
‫Marcus is asking about demon lists as well as is it possible for us to.
‫Yeah but that's a different thing.
‫I mean this is not demon unless this is ruthless and the basically the difference is that demon.
‫You should not be needing any demon behind that and we don't care.
‫We don't share with anyone else.
‫I think that we could do something with container and the maybe.
‫Right.
‫Yeah.
‫Yeah that's true.
‫I mean I guess fundamentally that would be.
‫I can see how that would be a little tricky because the democracy allied just talks to you.
‫Yeah.
‫Basically a duck or shall I say the way it is being ends in the design is that the client server.
‫So yeah we have a demo.
‫It would almost be like their lead would be there need to be a SEAL I add on that in the background
‫is just really running a docker.
‫The Docker D process but not technically running it as a demon and it's just running into the heart
‫of the docker run.
‫And yeah because you couldn't do that around d d right.
‫You'd have to do it.
‫Okay.
‫Yeah that would be an interesting use case for you actually be for example.
‫So initiation.
‫Basically what you want is you want to be able to create containers.
‫But the problem is that if you share VCA should do that you want to write anything container as well.
‫Then you basically need containers inside the container and then this makes it more complicated.
‫One way of overriding that is basically you can do containers alongside containers.
‫So basically exposing your dog so get inside your container and you can draw more containers inside.
‫But in the same deck and engine and the other thing that you can do is you get on the docket inside
‫the doctor.
‫So basically you can share a demon inside your CIC the container and the other one.
‫Basically this shelter in order to eliminate more of the restriction that the doctor initiated the shares
‫because previously you needed to ship privileges more dating and if you are using user long maybe these
‫people mod is not necessary in order to do -- inside your own container.
‫But having tested that nice either.
‫Yeah.
‫And if you could have demand less then that would simplify a lot.
‫Euros a city in order to not share a demon don't get inside your endocrine system.
‫Lots more questions.
‫I don't actually think that's a question in there about checking binaries or applications inside a container
‫or working perfectly or not.
‫Any Docker features in there.
‫No there are no new features related to that and that's not related to demon lists or rootless Docker
‫rather.
‫There's really Dockers already already has all the features you really need to check binaries or applications
‫for working perfectly.
‫You have Docker logs you have Docker events you have the docker demon logs.
‫You might want to check on my YouTube channel for that because we talked about last week.
‫We actually have sysadmin show we talked all through the different levels of logging and and events
‫and monitoring stuff in Docker so check that out.
‫That's Brett Fisher dot com slash YouTube and then search in there for sysadmin and you can find that
‫question that was a good question though.
‫What from a security perspective.
‫What's the difference between using a rootless containers and user name spaces
‫depending how are you going to create your user name spaces if you need to have root access in order
‫to create them then basically you don't get ruthless.
‫But the question is not where do you run them is how you create them.
‫And basically they're ruthless models that you create your user name spaces below your own user namespace
‫Yeah I mean I guess technically it's funny depending on how technically you want to get I think sweetened
‫rootless containers and user name spaces is that in user name spaces which I'm a big fan of but that
‫the rootless stuff right.
‫That's gonna be.
‫That's gonna be more about only things being in my user and the user name spaces means the docker demons
‫still running root which means I have to have root access I have to build a run Docker as root I have
‫to be in the docker group at least to get access to that and then the user name spaces means that the
‫user running in the container and the container itself are not running under the root process but if
‫there were some like zero day bug and that dog or demon that allowed you to somehow hop into the demon
‫from the container then maybe the username spaces wouldn't help you with that.
‫Maybe I don't know it's from a security perspective.
‫I think you could sit here and debate that all day.
‫Which one's better.
‫I'd say it's more about the use cases right like if this is more about like I don't I don't even want
‫to have anything even possibly being rude.
‫The one thing we don't have in rootless user name spaces by the way for Dr. demon yet which I'm hoping
‫we'll get to someday is where you can run duck or demon then run user name spaces and what that means
‫fundamentally is that every container is running as a non root user but right now they're not different
‫users.
‫So every container running in user name spaces is the same user account and it would be super cool for
‫security if we ran that where every single container you launch was a different user which means they
‫could if someone had a container or exploit they could they couldn't get it contained on a different
‫container.
‫Yeah yeah that was a I think because the user namespace feature was largely written by another doctor
‫captain and Phil Estes who's been on the show talked about that last year actually on username spaces
‫and I kind of asked him like are we going to get to the user in user name spaces user per container
‫thing which they call that like like user name spaces 2.0 and WI and he was like I don't know if anyone
‫is anyone want to build that feature and so it would it would be a cool feature but I don't think it
‫is working out yet.
‫Oh so Marcus is saying swarm acquires loading kernel modules and usually add routes so you can't use
‫overlay I think is one of the limitations overlay requires kernel modules.
‫Maybe the virtual thingy here.
‫Yeah I think overlaying works in the 1.
‫There is plans attacking I think they are thinking about dreaming about but about of their failing systems.
‫Bikers asking if I exist into a rootless container.
‫Is there a password to access route or pseudo de route or is route completely unavailable
‫I think the routes inside the container is basically the a user of the course of the a demon but I think
‫that's awesome.
‫Yeah.
‫So yeah.
‫That's it.
‫I like that answer.
‫That's yeah.
‫If you so if you're in the container and you are the root user in the container you still have no more
‫privileges than what the docker demon's running out on the host which is your user account.
‫So in the container you could.
‫I mean technically you could give route in a container or password.
‫You could make budget users in the container but on the host file system they wouldn't have you know
‫other words because that would be an escalation and privileges beyond what you're allowed to do right.
‫So thank you so much Dmitri.
‫That's really cool stuff that I didn't realize it was that easy to install with the script now that
‫the original post that was put out by the docker team was a little daunting to look at because I like
‫to.
‫This is a this is an hour of my time to get it installed but now that I've got an install script like
‫you have for regular Docker it goes yeah it goes great.