you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 11 months ago (1 child)

a program that runs as root

Does it have to run as root? It's common to run Docker in rootless mode in production environments.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 11 months ago* (last edited 11 months ago)

    while docker does have a non-root installer, the default installer for docker is docker as root, containers as non-root, but since in order to manage docker as a whole it would need access to the socket, if docker has root the container by extension has root.

    Even so, if docker was installed in a root-less environment then a compromised manager container would still compromise everything on that docker system, as a core requirement for these types of containers are access to the docker socket which still isn't great but is still better than full root access.

    To answer the question: No it doesn't require it to function, but the default configuration is root, and even in rootless environment a compromise of the management container that is meant to control other containers will result in full compromise of the docker environment.

  • source
  • parent