Using 'root' user accounts instead of non-root user within docker containers?

[grctest]

Hey,

I've been messing around with boinc-server-docker trying to make my own project and noticed that within the dockerfile images you're using the user 'root' instead of a non-root user.

Do you think we should use non-root user accounts within the containers to increase security?

Cheers,
CM.

[marius311]

This is a very good question. I mostly picked root out of convenience (since files COPYed in via Dockerfile have root permissions by default, so it would require a separate RUN chown ... && chgrp ... to get them a different user).

Most likely non-root would be slightly safer, but it hasn't been at the top of my TODO list because I don't actually think its that much safer. Apache and Mysql run as their usual non-root respective users, so any RCE there is no more dangerous than usual. Its only the daemons that run as root, so I suppose the attack would have to go through Apache/Mysql, then somehow attack daemons via how they communicate with Apache/Mysql (unless I'm mistaken and theres a daemon thats talks to the world?). In any case, the initial Apache/Mysql attack would basically let the attacker do anything they wanted including alter the website / read or edit the DB, so gaining root via the daemons seems like extra work for no gain. Hence, I'm not too worried about it. Although I'm very open hearing other opinions.

Note also that Docker actually is a layer of security b/c even if an attacker gains RCE in Apache/Mysql or even as root, without an (as of yet non-existant) Docker breakout attack, they can't do anything to the machine running the containers.

[marius311]

Since moby/moby#34263 was merged, the need to run RUN chown ... && chgrp ... is now gone, we can just do COPY --chown, so there's not much reason not to switch to non-root daemons. I probably don't have the time to do this right now, but if anyone wanted to tinker with this, a PR is more than welcome!

[lfield]

The principle of least privilege should still be followed. Even if it is to just ensure that good habits are maintained. Also anything developed inside a container may have a chance to run outside.

[marius311]

Closed by #43