Somewhere in your cluster there’s probably a deployment sitting in the default namespace that everyone knows shouldn’t be there. Nobody put it there maliciously, it just happened, early on…

overdrawn98901: > 2. Pretty sure all browsers require disabling hardened malloc, even Trivalent > oh that’s interesting, this I didn’t knew! overdrawn98901: > 3. Mullvad Browser is available as a flatpak, unsure if it’s the “official” one, but I didn’t go that route > it ain’t official, Tor Browse does has an official Flatpak but, as a post here from RoyalOughtness (secureblue’s lead dev I imagine) said, you shouldn’t be using browsers through flatpaks until nested namespaces so I was waiting for that (even tho it does seem the best course of action is to run Tor Browser on Whonix in a VM, I do like having it on my system tho) overdrawn98901: > 4. Don’t let sour grapes deter you. If your focus is security, then secure blue is reasonably secure by default (for Linux). I gave up trying to tweak a distro to be secure. > yeah nearly at that point myself, would probably just need to buy another HDD to backup a few things since all the ones I Have are already full and then make the switch (I do hope that Spectrum actually becomes usable enough as a daily driver tho as a nixpkg enjoyer ngl, if they accepted XMR donations I’d have donated quite a while ago now too) I guess only thing holding me back from secureblue (other than the entire hardened_malloc thingy not working 100% with all apps ig) is the fact that, I do have some applications I use that don’t have an official flatpak nor do they have an RPM, all they have is an AppImage (which I think you can’t install these on secureblue iirc) and some don’t have any replacement that could be used instead (it’s only my Switch and PS3 emulators tho) Also at some point in my life I did tried using all flatpaks for everything on a Fedora install (which looking back it was not the brightest ideas, I guess some stuff really aren’t made to be used as a flatpak) and the entire system felt slow af, boot times took longer than Windows and applications would NEVER just open instantly like they currently do rn for me at NIxOS (keep in mind my computer is some 2019 entry level gaming laptop and while I do have a 512GB NVME most of my storage is HDD) so this definitely didn’t left a good impression on flatpaks ngl lol (even if I’m willing to give them a go again)

ESP32 'Preferences' utility library for management of persistent settings, avoiding name clashes by using namespaces and transactions. - dejwk/roo_prefs

Syd is a Linux application sandbox using seccomp, Landlock and namespaces to control filesystem, network and process behaviour. The post Syd – configurable application sandbox for Linux appeared first on LinuxLinks.

Kyverno versions earlier than 1.19.1 do not correctly check specially encoded URLs in its policy calls.

bubblewrap is a low-level Linux sandboxing tool for constructing restricted process environments with namespaces, bind mounts and seccomp. The post bubblewrap – low-level unprivileged sandboxing tool appeared first on LinuxLinks.

Why do some Office charts fail to load in LibreOffice? The answer is the 'chartex' namespace. Microsoft uses proprietary extensions that break interoperability despite ISO claims. Another step toward

You run a container as root. That sounds dangerous. But here's a more interesting question: **Which root?** Root inside the container? Root on the host? Or the root user running the Docker daemon? They aren't necessarily the same thing. And understanding that difference changes how you think about Docker security. We've already seen that containers rely on namespaces, capabilities, seccomp, and other Linux mechanisms for isolation. Now let's go one level deeper. **What if Docker itself didn't need root privileges in the first place?** That's where Rootless Docker enters the picture. ## 1. Why Docker Has So Much Power When you run: docker run nginx the Docker CLI isn't creating the container by itself. A simplified flow looks like this: User │ ▼ Docker CLI │ ▼ Docker Daemon │ ▼ Container Runtime │ ▼ Linux Kernel In a traditional Docker installation, the Docker daemon normally runs with **root privileges**. That's powerful because container management involves operations around: * Namespaces * cgroups * Networking * Filesystems * Processes But that power creates an important security boundary. If someone gains unrestricted control over a rootful Docker daemon, they may gain extremely powerful access to the host. So Docker security isn't only about: > **"Is my application running as root?"** You also need to ask: > **"Who controls Docker itself?"** ## 2. The Docker Socket Is a Security Boundary You've probably seen: /var/run/docker.sock The Docker CLI commonly communicates with the Docker daemon through this Unix socket. That makes access to the socket much more powerful than it might initially appear. Someone with sufficient Docker access could potentially create highly privileged containers or expose sensitive host resources inside them. That's why blindly doing this is dangerous: -v /var/run/docker.sock:/var/run/docker.sock It might look like you're simply giving a container access to Docker. In reality, you're exposing a **highly privileged control interface**. A useful mental model is: > **Protect access to the Docker daemon like you protect administrative access to the host.** And this leads to the next question. If the daemon itself is so powerful, **does it always need to run as root?** ## 3. Container Root ≠ Host Root Before answering that, we need to clarify what **root** actually means. Suppose a process inside a container reports: uid=0(root) It's root inside that environment. But that doesn't necessarily mean it must have the same identity or privileges as UID 0 on the host. Linux **user namespaces** can map identities inside one namespace to different identities outside it. Conceptually: Container Host UID 0 (root) ────────▶ UID 100000 UID 1 ────────▶ UID 100001 UID 2 ────────▶ UID 100002 ... Inside the namespace: UID 0 = root From the host's perspective, that identity can correspond to an unprivileged UID. This creates an important distinction: > **Root inside a user namespace doesn't necessarily mean root on the host.** That's one of the ideas Rootless Docker builds upon. ## 4. So What Is Rootless Docker? Traditional Docker commonly looks like this: Normal User │ ▼ Docker CLI │ ▼ Docker Daemon (root) │ ▼ Containers │ ▼ Linux Kernel Rootless Docker changes the privilege model: Normal User │ ▼ Docker CLI │ ▼ Docker Daemon (non-root) │ ▼ User Namespace │ ▼ Containers │ ▼ Linux Kernel The Docker daemon runs without host-root privileges, while user namespaces and other Linux mechanisms allow container operations to happen from an unprivileged user context. A process may still appear as: uid=0(root) inside its user namespace. But that identity can be mapped to an unprivileged identity on the host. Why does that matter? Because if something compromises the daemon or a container, the attack begins from a **less privileged position**. That's the real value of Rootless Docker. > **Rootless Docker doesn't make compromise impossible. It reduces what a compromise starts with.** ## 5. Rootful vs Rootless: What Actually Changes? Here's the simpler mental model: Question | Rootful Docker | Rootless Docker ---|---|--- Docker daemon | Runs as root | Runs as a normal user User namespaces | Not inherently required for the daemon's privilege model | Fundamental to the rootless model Host privilege exposure | Higher | Reduced Low-level host access | Easier | More restricted Compatibility | Broad | Some limitations Security posture | Requires careful privilege management | Reduces daemon privileges by design Rootless doesn't eliminate Docker security concerns. It changes the **starting privilege level**. And that's important. But there's another trap here. It's tempting to think: > "Docker is rootless now. Problem solved." Not quite. ## 6. Rootless Is Only One Security Layer A container can still have more access than the application actually needs. Rootless Docker answers one question: > **How much host privilege does Docker itself start with?** It doesn't answer every other security question. For example: * Which privileged operations can the application perform? * Can it gain additional privileges? * Can it modify its filesystem? * Which system calls can it make? * Which host resources can it access? That's why container security works better as layers. Each layer removes a different kind of unnecessary power. **Security isn't one wall.** **It's a series of boundaries an attacker has to cross.** ## 7. Reduce What the Container Can Do Linux traditionally gives root enormous power. Capabilities split many privileged operations into smaller units. Docker already starts containers with a reduced set of Linux capabilities. But for workloads that allow it, you can go further. Start by dropping all capabilities: docker run \ --cap-drop=ALL \ nginx Then add back only what the workload genuinely requires. For example: docker run \ --cap-drop=ALL \ --cap-add=NET_BIND_SERVICE \ nginx The principle is simple: > **Start with less privilege. Add privilege only when the workload proves it needs it.** There's another question: What if the process starts with limited privileges but later finds a way to gain more? Docker provides another useful control: --security-opt no-new-privileges=true For example: docker run \ --security-opt no-new-privileges=true \ nginx This tells the kernel that processes in the container should not gain additional privileges through mechanisms such as setuid or setgid binaries. So these controls answer two different questions: **Capabilities** > What privileged operations can this process perform? **no-new-privileges** > Can this process gain more privilege later? That's a much stronger model than simply asking whether the process is called `root`. ## 8. Reduce What the Container Can Change Now suppose an attacker compromises the application. Even with reduced privileges, another question matters: > **What can the process modify?** Many applications don't need to write to their entire container filesystem. If yours doesn't, Docker can make the root filesystem read-only: docker run --read-only nginx That reduces the places where a compromised process can modify: * Application files * Binaries * Configuration * Other filesystem content Some applications still need writable locations for temporary files or runtime data. Those can be provided separately. For example: docker run \ --read-only \ --tmpfs /tmp \ nginx The security principle is straightforward: > **If something doesn't need write access, don't give it write access.** ## 9. Reduce What the Container Can Reach Containers share the host's Linux kernel. That makes the kernel interface another important boundary. ### seccomp Applications interact with the kernel using **system calls**. Docker's default seccomp profile blocks many system calls that typical containers don't require. For many workloads, keeping Docker's default profile is a sensible starting point. More sensitive environments can use more restrictive workload-specific profiles. The principle remains the same: > **Allow what is required. Reduce everything else.** ### AppArmor and SELinux Normal Unix permissions aren't the only way Linux can control access. Mandatory Access Control systems such as: * AppArmor * SELinux can enforce additional policies around what processes are allowed to access. Think of ordinary permissions as asking: > "Does this user normally have permission?" Mandatory Access Control adds another question: > **"Even if normal permissions allow it, does security policy allow it?"** These controls don't replace Rootless Docker. And Rootless Docker doesn't replace them. They protect different boundaries. ## 10. Where Rootless Docker Doesn't Fit At this point Rootless Docker might sound like something that should simply be enabled everywhere. But security controls come with trade-offs. Depending on the environment, Rootless Docker can have differences or limitations involving areas such as: * Networking * Privileged ports * cgroup behavior or configuration * Storage * Host integration * Certain low-level workloads Some workloads genuinely require deeper host access that doesn't fit well with a rootless environment. So the goal isn't: > **"Rootless everywhere at any cost."** The better principle is: > **"Use the least privilege that still allows the workload to function correctly."** Rootless Docker is especially worth evaluating where reducing daemon privilege is valuable and the workload doesn't require functionality incompatible with the rootless model. ## 11. Putting the Layers Together Now the individual controls start making more sense. Instead of simply: docker run nginx a more restricted workload might look conceptually like: docker run \ --read-only \ --cap-drop=ALL \ --cap-add=NET_BIND_SERVICE \ --security-opt no-new-privileges=true \ --memory=512m \ --cpus=1.0 \ nginx Not every application will work with exactly this configuration. And that's actually the important part. Hardening forces you to ask: > **What does this application actually need?** Instead of: > "What can I give it so it definitely works?" Those are very different security mindsets. A practical review might ask: * Can the application run as a non-root user? * Can Docker itself run rootless? * Which capabilities does the workload actually require? * Can `no-new-privileges` be enabled? * Can the root filesystem be read-only? * Is seccomp protection active? * Is AppArmor or SELinux available? * Is Docker socket access tightly controlled? * Are resource limits configured? * Is `--privileged` being avoided unless there is a specific requirement? The goal isn't to enable every option blindly. It's to understand **why each privilege exists**. ## Final Thought Docker security becomes easier to understand when you stop thinking of **root** as one universal identity. There is: * The user running Docker * The Docker daemon * The process inside the container * The user namespace * The host kernel Those identities and privilege boundaries interact. That's why: > **Root inside a container doesn't automatically mean root on the host.** And it's why Rootless Docker matters. But Rootless Docker is only one part of the larger idea. Capabilities reduce what a process can do. `no-new-privileges` limits privilege escalation. Read-only filesystems reduce what can be changed. seccomp reduces unnecessary kernel access. AppArmor and SELinux add additional policy boundaries. User namespaces change what identities mean outside the container. The strongest container isn't necessarily the one with the most security features enabled. It's the one that has **only the privileges it actually needs.** ## Question for You If your application works perfectly with fewer privileges, **what reason is there to give it more?** Have you tried Rootless Docker in a development or production environment?

ESP32 'Preferences' utility library for management of persistent settings, avoiding name clashes by using namespaces and transactions. - dejwk/roo_prefs