What Is It We Want in Containers Anyways?

Total Page：16

File Type：pdf, Size：1020Kb

WHAT IS IT WE WANT IN CONTAINERS ANYWAYS? Vincent Batts @vbatts bit.ly/vbatts-containers-anyways bit.ly/252kBnL $> finger $(whoami) Login: vbatts Name: Vincent Batts Directory: /home/vbatts Shell: /bin/bash Such mail. Plan: OHMAN $> id -Gn devel opencontainers docker appc redhat golang slackware SO, WHY, CONTAINERS? Single Application Full System But Not a VM Except Maybe a VM Pods of applications Labels of services Non-root Desktop Applications OMG AND CATS https://www.flickr.com/photos/27549668@N03/ But wait, What does "container" mean to you? But wait, What does "container" mean to you? USE-CASE Reproducibility USE-CASE Ephemeral Environments USE-CASE Freedom from host restrictions USE-CASE Easy delivery USE-CASE Integrate to existing process USE-CASE Controls and knobs BUILD Dockerfile Source to Image (github.com/OpenShift/source-to-image) appc/acbuild (github.com/appc/acbuild) Your own Makefiles? SHARING registry (i.e. docker-registry, dockyard) Host it yourself (i.e. tarballs on an http server) Share recipes! TOOLS LXC / LXD lmctfy Docker systemd-nspawn runC bubblewrap TECH Namespaces Resource Controls Security and Isolation SYSTEMD systemd directives Security Slides (CoreOS Fest2016) SHELL unshare(1) mount(8) shared subtrees chroot(1) procfs, sysfs, tmpfs cgroup filesystem (not for the faint of heart) STANDARDS! Standard /ˈstandəd/ noun something used as a measure, norm, or model in comparative evaluations STANDARDS! Areas to Standardize: Packaging Runtime Networking Cloud Call to Action! Define your use-cases first Get involved in the conversations Ensure your container integration touchpoint stay generic, to avoid lock-in to a particular platform. PoC tooling for your integration VINCENT BATTS @VBATTS| [email protected] THANKS!.

Copy Link

Recommended publications

Making Linux Protection Mechanisms Egalitarian with Userfs
Making Linux Protection Mechanisms Egalitarian with UserFS Taesoo Kim and Nickolai Zeldovich MIT CSAIL ABSTRACT firewall rules, forcing applications to invent their own UserFS provides egalitarian OS protection mechanisms protection techniques like system call interposition [15], in Linux. UserFS allows any user—not just the system binary rewriting [30] or analysis [13, 45], or interposing administrator—to allocate Unix user IDs, to use chroot, on system accesses in a language runtime like Javascript. and to set up firewall rules in order to confine untrusted This paper presents the design of UserFS, a kernel code. One key idea in UserFS is representing user IDs as framework that allows any application to use traditional files in a /proc-like file system, thus allowing applica- OS protection mechanisms on a Unix system, and a proto- tions to manage user IDs like any other files, by setting type implementation of UserFS for Linux. UserFS makes permissions and passing file descriptors over Unix do- protection mechanisms egalitarian, so that any user—not main sockets. UserFS addresses several challenges in just the system administrator—can allocate new user IDs, making user IDs egalitarian, including accountability, re- set up firewall rules, and isolate processes using chroot. source allocation, persistence, and UID reuse. We have By using the operating system’s own protection mecha- ported several applications to take advantage of UserFS; nisms, applications can avoid race conditions and ambi- by changing just tens to hundreds of lines of code, we guities associated with system call interposition [14, 43], prevented attackers from exploiting application-level vul- can confine existing code without having to recompile or nerabilities, such as code injection or missing ACL checks rewrite it in a new language, and can enforce a coherent in a PHP-based wiki application.
[Show full text]
Sandboxing 2 Change Root: Chroot()
Sandboxing 2 Change Root: chroot() Oldest Unix isolation mechanism Make a process believe that some subtree is the entire file system File outside of this subtree simply don’t exist Sounds good, but. Sandboxing 2 2 / 47 Chroot Sandboxing 2 3 / 47 Limitations of Chroot Only root can invoke it. (Why?) Setting up minimum necessary environment can be painful The program to execute generally needs to live within the subtree, where it’s exposed Still vulnerable to root compromise Doesn’t protect network identity Sandboxing 2 4 / 47 Root versus Chroot Suppose an ordinary user could use chroot() Create a link to the sudo command Create /etc and /etc/passwd with a known root password Create links to any files you want to read or write Besides, root can escape from chroot() Sandboxing 2 5 / 47 Escaping Chroot What is the current directory? If it’s not under the chroot() tree, try chdir("../../..") Better escape: create device files On Unix, all (non-network) devices have filenames Even physical memory has a filename Create a physical memory device, open it, and change the kernel data structures to remove the restriction Create a disk device, and mount a file system on it. Then chroot() to the real root (On Unix systems, disks other than the root file system are “mounted” as a subtree somewhere) Sandboxing 2 6 / 47 Trying Chroot # mkdir /usr/sandbox /usr/sandbox/bin # cp /bin/sh /usr/sandbox/bin/sh # chroot /usr/sandbox /bin/sh chroot: /bin/sh: Exec format error # mkdir /usr/sandbox/libexec # cp /libexec/ld.elf_so /usr/sandbox/libexec # chroot /usr/sandbox
[Show full text]
The Linux Command Line
The Linux Command Line Fifth Internet Edition William Shotts A LinuxCommand.org Book Copyright ©2008-2019, William E. Shotts, Jr. This work is licensed under the Creative Commons Attribution-Noncommercial-No De- rivative Works 3.0 United States License. To view a copy of this license, visit the link above or send a letter to Creative Commons, PO Box 1866, Mountain View, CA 94042. A version of this book is also available in printed form, published by No Starch Press. Copies may be purchased wherever fine books are sold. No Starch Press also offers elec- tronic formats for popular e-readers. They can be reached at: https://www.nostarch.com. Linux® is the registered trademark of Linus Torvalds. All other trademarks belong to their respective owners. This book is part of the LinuxCommand.org project, a site for Linux education and advo- cacy devoted to helping users of legacy operating systems migrate into the future. You may contact the LinuxCommand.org project at http://linuxcommand.org. Release History Version Date Description 19.01A January 28, 2019 Fifth Internet Edition (Corrected TOC) 19.01 January 17, 2019 Fifth Internet Edition. 17.10 October 19, 2017 Fourth Internet Edition. 16.07 July 28, 2016 Third Internet Edition. 13.07 July 6, 2013 Second Internet Edition. 09.12 December 14, 2009 First Internet Edition. Table of Contents Introduction....................................................................................................xvi Why Use the Command Line?......................................................................................xvi
[Show full text]
SUSE Linux Enterprise Server 12 Does Not Provide the Repair System Anymore
General System Troubleshooting Sascha Wehnert Premium Service Engineer Attachmate Group Germany GmbH [email protected] What is this about? • This session will cover the following topics: ‒ How to speed up a service request ‒ How to gather system information using supportconfig ‒ Configure serial console in grub to trace kernel boot messages ‒ Accessing a non booting systems using the rescue system ‒ System crash situations and how to prepare (i586/x86_64 only) 2 The challenge of a service request • Complete service request description: “We need to increase our disk space.” 3 The challenge of a service request • Which SUSE® Linux Enterprise Server version? • Is this a physical or virtual environment? • If virtual, what virtualization solution is being used? • If physical, local SCSI RAID array? What hardware? • If using HBAs, dm-multipathing or iSCSI connected disks or a 3rd party solution? • Disk and system partition layout? • What has been done so far? What was achieved? What failed? • What information do I need in order to help? 4 What information would be needed? • SUSE Linux Enterprise Server version → /etc/SuSE-release, uname -a • Physical → dmidecode XEN → /proc/xen/xsd_port KVM → /proc/modules • Hardware information → hwinfo • Partition information → parted -l, /etc/fstab • Multipathing/iSCSI → multipath, iscsiadm • Console output or /var/log/YaST2/y2log in case YaST2 has been used 5 supportconfig • Since SUSE Linux Enterprise Server 10 SP4 included in default installation. • Maintained package, updates available via patch channels. For best results always have latest version installed from channels installed. • One single command to get (almost) everything. • Splits data into files separated by topic. • Can be modified to exclude certain data, either via /etc/supportconfig.conf or command options.
[Show full text]
Scripting in Axis Network Cameras and Video Servers
Scripting in Axis Network Cameras and Video Servers Table of Contents 1 INTRODUCTION .............................................................................................................5 2 EMBEDDED SCRIPTS ....................................................................................................6 2.1 PHP .....................................................................................................................................6 2.2 SHELL ..................................................................................................................................7 3 USING SCRIPTS IN AXIS CAMERA/VIDEO PRODUCTS ......................................8 3.1 UPLOADING SCRIPTS TO THE CAMERA/VIDEO SERVER:...................................................8 3.2 RUNNING SCRIPTS WITH THE TASK SCHEDULER...............................................................8 3.2.1 Syntax for /etc/task.list.....................................................................................................9 3.3 RUNNING SCRIPTS VIA A WEB SERVER..............................................................................11 3.3.1 To enable Telnet support ...............................................................................................12 3.4 INCLUDED HELPER APPLICATIONS ..................................................................................13 3.4.1 The image buffer - bufferd........................................................................................13 3.4.2 sftpclient.........................................................................................................................16
[Show full text]
Guidance on Sftp Chroot Access
Guidance On Sftp Chroot Access How comedic is Husein when tuberculose and untumbled Horace tango some bedstraw? Fucoid Sutherland revenge troubledly and alow, she regives her canvassing unfree unrecognisable. Sayer remains owlish: she phlebotomises her slaister distaste too glowingly? The server performs a chroot2 command to visit home loss of the ftp user. 13 2006 World Meteorological Organization WMO Guide to use of FTP and. Using sftp 199 Setting Permissions for File Uploads 200 244. CVE-2021-1145 A vulnerability in house Secure FTP SFTP of Cisco StarOS for Cisco. Match group yourgroupname ChrootDirectory home X11Forwarding no. Chroot A Linux command used to trace the root before It so often used for sandboxing. The Debian Administrator's Handbook. Selinux context to access on using ecr is to execute permissions of this is. Be replaced by sftp if possible ftp sftp access should be chrooted to. Both rsh and ssh require some coordination between the client and server. If you guidance on sftp chroot access is guidance on ams managed microsoft azure to chroot enforcements on. Are we in a chrooted jail and cannot access the hum system directly. Uses a Linux concept began as CHROOT to physically isolate each SFTP user to a violent part error the filesystem Thus art is lawn for an SFTP user to book another user's data. The file systems serving malware or are required so multiple queues and sftp on volatile data corruption, as having a long as efficiently run a long. The CA Access Control documentation uses the following file location. Guide following the Secure Configuration of another Hat Enterprise Linux.
[Show full text]
The Linux Command Line
The Linux Command Line Second Internet Edition William E. Shotts, Jr. A LinuxCommand.org Book Copyright ©2008-2013, William E. Shotts, Jr. This work is licensed under the Creative Commons Attribution-Noncommercial-No De- rivative Works 3.0 United States License. To view a copy of this license, visit the link above or send a letter to Creative Commons, 171 Second Street, Suite 300, San Fran- cisco, California, 94105, USA. Linux® is the registered trademark of Linus Torvalds. All other trademarks belong to their respective owners. This book is part of the LinuxCommand.org project, a site for Linux education and advo- cacy devoted to helping users of legacy operating systems migrate into the future. You may contact the LinuxCommand.org project at http://linuxcommand.org. This book is also available in printed form, published by No Starch Press and may be purchased wherever fine books are sold. No Starch Press also offers this book in elec- tronic formats for most popular e-readers: http://nostarch.com/tlcl.htm Release History Version Date Description 13.07 July 6, 2013 Second Internet Edition. 09.12 December 14, 2009 First Internet Edition. 09.11 November 19, 2009 Fourth draft with almost all reviewer feedback incorporated and edited through chapter 37. 09.10 October 3, 2009 Third draft with revised table formatting, partial application of reviewers feedback and edited through chapter 18. 09.08 August 12, 2009 Second draft incorporating the first editing pass. 09.07 July 18, 2009 Completed first draft. Table of Contents Introduction....................................................................................................xvi
[Show full text]
Running Untrusted Application Code: Sandboxing Running Untrusted Code
Running Untrusted Application Code: Sandboxing Running untrusted code We often need to run buggy/unstrusted code: programs from untrusted Internet sites: toolbars, viewers, codecs for media player old or insecure applications: ghostview, outlook legacy daemons: sendmail, bind honeypots Goal : if application “misbehaves,” kill it Approach: confinement Confinement : ensure application does not deviate from pre-approved behavior Can be implemented at many levels: Hardware : run application on isolated hw (air gap) difficult to manage Virtual machines : isolate OS’s on single hardware System call interposition : Isolates a process in a single operating system Isolating threads sharing same address space: Software Fault Isolation (SFI) Application specific: e.g. browser-based confinement Implementing confinement Key component: reference monitor Mediates requests from applications Implements protection policy Enforces isolation and confinement Must always be invoked: Every application request must be mediated Tamperproof : Reference monitor cannot be killed … or if killed, then monitored process is killed too Small enough to be analyzed and validated A simple example: chroot Often used for “guest” accounts on ftp sites To use do: (must be root) chroot /tmp/guest root dir “/” is now “/tmp/guest” su guest EUID set to “guest” Now “/tmp/guest” is added to file system accesses for applications in jail open(“/etc/passwd”, “r”) ⇒⇒⇒ open(“/tmp/guest/etc/passwd”, “r”) ⇒ application cannot access files outside of jail Jailkit Problem: all utility progs (ls, ps, vi) must live inside jail • jailkit project: auto builds files, libs, and dirs needed in jail environment • jk_init : creates jail environment • jk_check: checks jail env for security problems • checks for any modified programs, • checks for world writable directories, etc.
[Show full text]
Gnu Coreutils Core GNU Utilities for Version 6.9, 22 March 2007
gnu Coreutils Core GNU utilities for version 6.9, 22 March 2007 David MacKenzie et al. This manual documents version 6.9 of the gnu core utilities, including the standard pro- grams for text and file manipulation. Copyright c 1994, 1995, 1996, 2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation, Inc. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the license is included in the section entitled \GNU Free Documentation License". Chapter 1: Introduction 1 1 Introduction This manual is a work in progress: many sections make no attempt to explain basic concepts in a way suitable for novices. Thus, if you are interested, please get involved in improving this manual. The entire gnu community will benefit. The gnu utilities documented here are mostly compatible with the POSIX standard. Please report bugs to [email protected]. Remember to include the version number, machine architecture, input files, and any other information needed to reproduce the bug: your input, what you expected, what you got, and why it is wrong. Diffs are welcome, but please include a description of the problem as well, since this is sometimes difficult to infer. See section \Bugs" in Using and Porting GNU CC. This manual was originally derived from the Unix man pages in the distributions, which were written by David MacKenzie and updated by Jim Meyering.
[Show full text]
Controlled Environment to Run Untrusted Applications
CONTROLLED ENVIRONMENT TO RUN UNTRUSTED APPLICATIONS A thesis submitted To Kent State University in partial Fulfillment of the requirements for the Degree of Master of Science by TAHANI ALBALAWI August, 2013 Thesis written by TAHANI ALBALAWI B.S., Taiba University, KSA 2007 M.S., Kent State University, USA, 2013 Approved by Michael Rothstein, Advisor Javed Khan , Chair, Department of Computer Science Raymond Craig, Dean, College of Arts and Sciences ii Abstract Untrusted applications pose a security threat to systems they run on. At the same time sometimes a user wants to run such applications without risking unauthorized access to certain parts of the system. For this reason we propose a controlled environment to run host untrusted applications based on AppArmor tool. We intend to augment the usefulness of AppArmor by further restricting the permissions of the files accessible to the process using other system mechanisms, such as NFS and Chroot. Based on the principle of least authority, programs can run in a restricted secure environment limiting access to a subset of the files. This way untrusted applications are allowed to run with limits to protect the system. iii Table of Contents LIST OF FIGURES ..................................................................................................... vii LIST OF TABLES ...................................................................................................... vii DEDICATION.............................................................................................................
[Show full text]
Guild Wars Microservices and 24/7 Uptime
Guild Wars Microservices and 24/7 Uptime Stephen Clarke-Willson, Ph.D. Studio Technical Director, ArenaNet Outline This talk is in four main parts: 1. Meta 2. Overview of microservices in Guild Wars 3. Orchestration 4. Restartability: Problems and solutions Part One: The Meta Introduction (me) ● Game development 25 years ● Mixed roles over time of producer, programmer, executive ● Big list of games at Mobygames (mostly accurate) ● Eleven years at ArenaNet Guild Wars and Guild Wars 2 ● Guild Wars introduced MMO-style game with no monthly fee; launched 2005 ● Guild Wars 2 is a larger, open-world game, with multiple game modes, and still no monthly fee; launched 2012 Talk meta ● Originally submitted in 2014 for GDC 2015 ● Advisory board feedback: that’s cool, but you don’t explain how to restart servers ● Me: I can’t even explain that to my staff ● Pulled talk to mull that over Microservices became a thing ● Kubernetes – 2014 ● Docker 1.0 – 2014 ● DockerCon – 2016 – gave me most of my terminology ● Suddenly I had a path to explaining how we build things Credit where credit is due ● Mike O’Brien designed and wrote original version of Battle.net at “another company” ● Pat Wyatt wrote most Guild Wars 1 back-end servers as restartable services ● Glen Knowles wrote the Guild Wars 2 microservice infrastructure and many of the services ● Halldor Fannar gave lots of constructive feedback on this talk Part Two: Overview of Guild Wars Services What is a microservice? ● Microservices are the evolution of the original Unix utility concept of “doing one thing well”. ● Microservices are like well factored subroutines … except asynchronous and separately restartable.
[Show full text]
Etrust Access Control for UNIX and Linux Utilities Guide
eTrust® Access Control for UNIX and Linux Utilities Guide r8 SP1 This documentation and any related computer software help programs (hereinafter referred to as the “Documentation”) is for the end user’s informational purposes only and is subject to change or withdrawal by CA at any time. This Documentation may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. This Documentation is confidential and proprietary information of CA and protected by the copyright laws of the United States and international treaties. Notwithstanding the foregoing, licensed users may print a reasonable number of copies of the documentation for their own internal use, and may make one copy of the related software as reasonably required for back-up and disaster recovery purposes, provided that all CA copyright notices and legends are affixed to each reproduced copy. Only authorized employees, consultants, or agents of the user who are bound by the provisions of the license for the product are permitted to have access to such copies. The right to print copies of the documentation and to make a copy of the related software is limited to the period during which the applicable license for the Product remains in full force and effect. Should the license terminate for any reason, it shall be the user’s responsibility to certify in writing to CA that all copies and partial copies of the Documentation have been returned to CA or destroyed. EXCEPT AS OTHERWISE STATED IN THE APPLICABLE LICENSE AGREEMENT, TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENTATION “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.
[Show full text]