The diffierence between privilege docker container and the user in container is root

[cucushift]

hi folks, I'm a novice on docker, i have a doubt as title say. what the diffierence between privilege docker container and the user in container is root? thanks.

[cucushift]

/labels question

[thaJeztah]

When running a process as root inside a regular container, that process is constrained by various security mechanisms, limiting what root can do inside the container.

Starting a container with --privileged, will remove most of those security mechanisms;

• The container gets all Linux capabilities (equivalent to --cap-add ALL)
• AppArmor is disabled for the container
• SELinux is disabled for the container
• seccomp is disabled for the container
• the container gets access to all devices on the host

For example:

Devices the container has access to on a non-privileged container;

docker run --rm busybox ls /dev/
core
fd
full
mqueue
null
ptmx
pts
random
shm
stderr
stdin
stdout
tty
urandom
zero

And when running with --privileged:

docker run --rm --privileged busybox ls /dev/
bsg
cachefiles
core
cpu
cpu_dma_latency
cuse
fd
full
fuse
hpet
hwrng
input
kmsg
loop-control
loop0
loop1
loop2
loop3
loop4
loop5
loop6
loop7
mapper
mem
memory_bandwidth
mqueue
nbd0
nbd1
nbd10
nbd11
nbd12
nbd13
nbd14
nbd15
nbd2
nbd3
nbd4
nbd5
nbd6
nbd7
nbd8
nbd9
net
network_latency
network_throughput
null
nvram
port
psaux
ptmx
pts
random
rtc0
sda
sda1
sg0
sg1
sg2
shm
sr0
sr1
stderr
stdin
stdout
tty
tty0
tty1
tty10
tty11
tty12
tty13
tty14
tty15
tty16
tty17
tty18
tty19
tty2
tty20
tty21
tty22
tty23
tty24
tty25
tty26
tty27
tty28
tty29
tty3
tty30
tty31
tty32
tty33
tty34
tty35
tty36
tty37
tty38
tty39
tty4
tty40
tty41
tty42
tty43
tty44
tty45
tty46
tty47
tty48
tty49
tty5
tty50
tty51
tty52
tty53
tty54
tty55
tty56
tty57
tty58
tty59
tty6
tty60
tty61
tty62
tty63
tty7
tty8
tty9
ttyS0
ttyS1
ttyS2
ttyS3
uinput
urandom
vcs
vcs1
vcsa
vcsa1
vsock
zero

Capabilities the process has on a non-privileged container:

docker run --rm alpine sh -c 'apk add --no-cache -qq libcap-ng-utils && pscap -a'

ppid  pid   name        command           capabilities
0     1     root        sh                chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap

The limited set of capabilities restrict the container to (for example) perform mounting (even though you are root):

docker run --rm alpine sh -c 'whoami && mkdir /foo /bar && mount -o bind /foo /bar'
root
mount: permission denied (are you root?)

However, when started with --privileged, you'll see that the container has full capabilities:

docker run --privileged --rm alpine sh -c 'apk add --no-cache -qq libcap-ng-utils && pscap -a'

ppid  pid   name        command           capabilities
0     1     root        sh                full

Having access to all devices, and having all capabilities means that the container has full root access to the host's filesystem even without a --volume being specified for the container. For example, the steps below show the container mounting the host's /dev/sda1 device, and being able to access any file:

# create a file on the host
echo "this is a file on the host" > /file-on-the-host

# start a privileged container that mounts the host's filesystem and reads the file
docker run --rm --privileged alpine sh -c 'mkdir /foo && mount /dev/sda1 /foo && cat /foo/file-on-the-host'
this is a file on the host

TL;DR when starting a container with --privileged, think twice: does the container really need full --privileged capabilities, or only some? (using --cap-add ... usually is a better choice).

[thaJeztah]

Please keep in mind that the GitHub issue tracker is not intended as a general support forum,
but for reporting bugs and feature requests. For other type of questions, consider using one of;

• the Docker Support Forums - https://forums.docker.com
• the Docker community Slack channel (register here: http://dockr.ly/community)
• StackOverflow

Feel free to continue the conversation though 👍

[cucushift]

@thaJeztah thanks.