this post was submitted on 07 Jan 2024
78 points (93.3% liked)

Linux

48310 readers
645 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
78
How to secure (podman or docker) containers for public-facing hosting? (lemmy.ml)
submitted 10 months ago* (last edited 10 months ago) by cyclohexane@lemmy.ml to c/linux@lemmy.ml
24 comments fedilink hide all child comments
 

Context

I want to host public-facing applications on a server in my home, without compromising security. I realize containers might be one way to do this, and want to explore that route further.

Requirements

I want to run applications within containers such that they

  • Must not be able to interfere with applications running on host
  • Must not be able to interfere with other containers or applications inside them
  • Must have no access or influence on other devices in the local network, or otherwise compromise the security of the network, but still accessible by devices via ssh.

Note: all of this within reason. I understand that sometimes there may be occasional vulnerabilities, like in kernel for example, that would eventually get fixed. Risks like this within reason I am willing to accept.

What I found so far

  • Running containers in rootless mode: in other words, running the container daemon with an unprivileged host user
  • Running applications in container under unprivileged users: the container user under which the container is ran should be unprivileged
  • Networking: The container's networking must be restricted. I am still not sure how to do this and shall explore it more, but would appreciate any resources.

Alternative solution

I have seen bubblewrap presented as an alternative, but it seems like it is not intended to be used directly in this manner, and information about using it for this is scarce.

you are viewing a single comment's thread
view the rest of the comments
[–] just_another_person@lemmy.world 9 points 10 months ago

Secure your network. Worry less about escalations in your containers. You're thinking too deeply about what is essentially a rabbit hole with a dead end for the most part, and if you don't understand why in the first place, you should read more to understand exactly what you're afraid of.

If you're thinking that on your personal home network (which should be reasonably secured anyway) that someone will get physical access, then get on your network and start scanning everything, then find the ports you have open on every host, then identify the specific versions of the http servers hosting your software, then run exploits to get past any authentication which should be there, THEN have superhax ready to escalate privileges on the container runtimes so they can run remote executions...that's all they'll be able to do unless you have volume mounts allowing access to your stuff everywhere in said containers.

If you live in fear of everything, you'll get nothing done.