[Kubernetes] 49. Docker Security

컨테이너는 Linux에서 네임스페이스를 이용해 격리된다.

docker run ubuntu sleep 3600
ps aux

docker run --user=1000 ubuntu sleep 3600
ps aux

Dockerfile
FROM ubuntu
USER 1000

docker build -t my-ubuntu-image .
docker run my-ubuntu-image sleep 3600
ps aux

 

Linux Capability (chown, dac, kill, setfcap, setcap, setgid, setuid, net_bind, net_raw, mac_admin, broadcast, net_admin, sys_admin, sys_chroot, audit_write, ...) => /usr/include/linux/capability.h 에서 확인 가능

 

docker run --cap-add MAC_ADMIN ubuntu
docker run --cap-drop=NET_RAW ubuntu
docker run --read-only ubuntu