Questions regarding user namespace separation

[Tronde]

Hi @pierrecnalb,
I learned about your project by your post to this opencloud discussion. I appreciate the work you put into this.

From your README.md I got:

The quadlets are designed to be used as root with the following features:

• pods are used to host related containers
• containers are properly isolated from each other within their own user namespace

Looking into the opencloud directory I see that you create a pod with option UserNS=auto. According to podman-pod-create(1) this creates one user namespace for the pod. So the containers assigned to the pod share the same user namespace.

So the containers are isoloated from one another on pod level, not on container level, right? Please don't take this as critisism, I'm asking for clarification as the README could be interpreted otherwise.

What do you think about using UserNS=auto with rootless users as Daniel suggested in this comment?

Best regards,
Tronde

[pierrecnalb]

Hi @Tronde,

Thanks for your comment! I am not taking it as criticism, quite the opposite actually, I was hoping to trigger some discussion to improve those quadlets.
Resources around quadlets are quite sparse and there are not much "best practices" guides, so it is really good if there could be proper discussion around that!

Regarding your first comment, you are correct: when using pod, UserNS=auto must be set at the pod level and creates one user namespace for the pod. My readme is indeed misleading, let me fix that!

What do you think about using UserNS=auto with rootless users as Daniel suggested in podman-container-tools/podman#13728 (reply in thread)?

You mean using the latest option he suggested? i.e.: " You could also setup a Huge /etc/subuid range for a user and then run lots of containers for that user with --userns=auto ... Which is probably the most secure."

Ultimately I think that would be great if those quadlets could be run as rootless, definitely.
It took me some times to understand podman and make it work properly, so I was doing a tradeoff to balance between security and ease of deployment.
My understanding from the conversation linked above, is that the only security issue by running rootful with userns=auto is that podman pulls images as root, so you need to trust the images. I may be mistaken, but this seemed quite reasonable to accept as a risk for now.

Using rootless would mean more unknown to me, but it's definitely something I would be interested to know/explore.
For example, I am still unclear how would caddy or any reverse proxy work as rootless etc...

[pierrecnalb]

Btw, I asked for that topic in the initial github discussion here

[Tronde]

Hi,
If you like to expolore rootless podman I recommend reading special considerations for rootless containers. It explains what you need to do if you like to bind privileged ports with a rootless user, too.

In the discussion you linked they talked about lingering withoug giving much context or how to enable it. Here is an excerpt from the loginctl(1) that should cover it:

       enable-linger [USER...], disable-linger [USER...]
           Enable/disable user lingering for one or more users. If enabled for
           a specific user, a user manager is spawned for the user at boot and
           kept around after logouts. This allows users who are not logged in
           to run long-running services. Takes one or more user names or
           numeric UIDs as argument. If no argument is specified,
           enables/disables lingering for the user of the session of the
           caller.

           See also KillUserProcesses= setting in logind.conf(5).

IMHO it should be up to the system administrator or user whether they like to run their containers rootful or rootless. Of you course you can make a recommenation for your favorite in your project. For my projects a working (rootless) podman environment is usually a prerequisite so I don't have to explain the whole setup process for rootless podman.

Thank you for following up on my questions and for putting your time and effort into the quadlets.

[pierrecnalb]

Thanks for the tips.

IMHO it should be up to the system administrator or user whether they like to run their containers rootful or rootless.

Indeed! I modified the README to emphasize that, simply mentioning some rootless/rootful considerations and the importance of userns=auto for server deployment basically