Submitted 2 days ago by mat@jlai.lu to selfhosted@lemmy.world
Hi all !
As of today, I am running my services with rootless podman pods and containers. Each functional stack gets its dedicated user (user cloud runs a pod with nextcloud-fpm, nginx, postgresql…) with user mapping. Now, my thought were that if an attack can escape a container, it should be contained to a specific user.
Is it really meaningful ? With service users’ home setup in /var/lib, it makes a lot of small stuff annoying and I wonder if the current setup is really worth it ?
The generally don’t containerize things because I’m too old and crusty, but segregating over several users is basically how it’s been done for ages, and while it may not be particularly useful in your case, I consider it a reasonable best practice that costs you nothing.
What kind of annoying things are you dealing with?
You don’t have to put the user home in /var/lib either if that helps at all.
If you’re already running rootless, I’d keep doing that unless there’s a really good reason not to.
You shouldn’t have any user home for your services, you shouldn’t even allow them to login at all. They should only have group access to resources they need, and containers should restrict what directories they have access to.
What kind of annoying things are you dealing with?
Troubleshooting with a machinectl session, switching between services, backing up… It is small annoyances but if I can avoid them i’d like it.
You don’t have to put the user home in /var/lib either if that helps at all.
I half regret doing it.
If you’re already running rootless, I’d keep doing that unless there’s a really good reason not to.
The plan is about switching to a single user, I will stick to rootless podman this is for sure. It is more about dedicated users or a single one.
I don’t want to tell you one way or the other because it’s kinda dubious anyway, but if all services run as the same user the need for root is kinda moot when it comes to crossing between services or expanding the scope of an attack. Of course it is better than all things running as root, but if I popped a machine as some “low privilege” user that still had access to all running services I’m not sure I’d care so much about escalating to root.
It’s always effort vs risk.
Since it’s a do once and forget kind of thing I’d rate effort rather low.
As for risk in the worst case scenario a single service being compromised means all of them are with the attacker getting access to everything those services can access, including all the credentials. Will you make an effort to be on top of all the updates for all services?
At home all containers for any service get a separate user. At work every container does.
One if my clients got hacked via an insecure application, that was used to get a shell, to then escalate to root via docker. Luckily it was a white hat team we hired.
Is it worth it to go rootless? Depends on your threat model
I am already running rootless podman. My question is more about dedicated service users vs single user to run everything, still in rootless podman. I like podman and its integration with systemd to manage the life cycle of the container compared to docker.
SMillerNL@lemmy.world 2 days ago
Af an attack can escape a container a lot of companies worldwide are going to need to patch a 0-day. I do not expect that to be part of my threat model for self-hosted services.
qqq@lemmy.world 2 days ago
Woah, no? Sure escaping via a kernel bug or some issue in the container runtime is unexpected, but I “escape” containers all the time in my job because of configuration issues, poorly considered bind mounts, or the “contained” service itself ends up being designed to manage some things outside of the container.
Might be valid to not consider it with the services you run, but that reasoning is very wrong.
sugar_in_your_tea@sh.itjust.works 22 hours ago
Companies don’t typically host multiple containers on the same host. So having a different user for them is less important than securing the connection between machines, since a given biat isn’t particularly interesting. Attackers will still try to break out, so they have a backup.
As a self-hoster, you typically do the opposite. You run multiple services on the same host, and the internal network isn’t particularly secure. So you should be focusing more on mitigating issues, and having each service run as an unprivileged user is one fairly easy way to do that.
fishinthecalculator@lemmy.ml 19 hours ago
Companies do run multiple containers/pods on the same host. That is what Kubernetes does
mat@jlai.lu 2 days ago
I guess I should define my threat model first. Your answer pulls me towards a single user though