search

OWASP / Docker-Security

Getting a handle on container security
https://owasp.org/www-project-docker-top-10/
Other
628 stars 130 forks source link

D01 - Secure User Mapping: Namespaces #10

Closed NF997 closed 3 years ago

NF997 commented 5 years ago

I disagree with the following lines: "The catch using namespaces is that you can only run one namespace at a time. If you run user namespacing you e.g. can't use network namespacing on the same host [6]." The cited document only states that it is not possible to share "PID or NET namespaces with the host" while using the user namespace, but that does not mean that generally speaking only one namespace can be used at a time. Furthermore, other documents and blog entries explicitly state that "[m]odern containerization systems (e.g. Docker, LXC, etc.) use all of these namespaces when programs are launched". (https://blog.selectel.com/containerization-mechanisms-namespaces/) Probably you meant the right thing but formulated it a bit ambiguous.

I would be very glad to hear your thoughts about this topic!

hartwork commented 4 years ago

I second that the current text is mis-leading.

drwetter commented 4 years ago

ack, it's on my list