Open Source Summit + ELC North America 2020

Unprivileged containers come with a range of security restriction enforced by the kernel. This includes not allowing the creation of character or block device nodes preventing a container from gaining access to e.g. any disk devices attached to the hardware or to write directly into kernel memory. The kernel will also prevent an unprivileged container from mounting most interesting filesystems. There are a wide range of other examples where the kernel access to interesting or crucial features to ensure the integrity of the system in the face of untrusted workloads for which unprivileged containers were designed.

In this talk we will show how new kernel features can be combined to overcome these restrictions and thereby making unprivileged containers more useable and powerful in a secure way.