Home / Knowledge hub / Rootless container
Knowledge hub
Rootless container
A container run as an ordinary user, limiting damage if it is broken into.
What it means
Rootless has two related meanings. A container can run its program as an ordinary user rather than the all-powerful root user. Or the container engine itself can run without root rights on the host, as with Docker's rootless mode and Podman. Both aim to make a break-out less valuable. Either way, the aim is the same: a break-in should land somewhere with little power.
By default, many containers run as root inside. Without extra isolation, that root can map to real root on the host. Break out of the container, and you may arrive with full power over the machine. Running as an ordinary user is the cheaper step, and most teams can take it today.
Why it matters
If an attacker takes over a program that runs as root, they can change files, install tools and try to escape to the host. If it runs as an unprivileged user, most of that fails. The same bug becomes a smaller incident. That difference is often what separates a contained bug from a reportable incident.
Several standards and cluster policies ask for this directly. The Kubernetes Pod Security Standards restricted profile requires containers to run as non-root, and reviewers will ask why an exception exists. It also supports the idea of least privilege, a principle security frameworks commonly ask for.
How it shows up
In an image, set a non-root USER. In Kubernetes, use runAsNonRoot and set allowPrivilegeEscalation to false. For the engine, use rootless Docker or Podman. Watch for files owned by root that the app needs to write. Scan your manifests and images for any container whose user is root or unset.
Typical snags are programs that listen on ports below 1024, which an unprivileged user cannot bind by default, and volumes with the wrong ownership. The fix is to listen on a higher port and set ownership correctly. Do not give up and go back to root.
Questions people ask
Rootless container, answered
Is non-root the same as rootless?
Not quite. Non-root usually means the program inside the container runs as an ordinary user. Rootless usually means the container engine runs without root on the host.
The strongest setup does both.
Does running as non-root stop a container escape?
It makes one much harder, since many escape routes need root. It does not make escape impossible if the kernel or runtime has a flaw.
Use it with other limits, such as seccomp and read-only file systems.
Why does my app fail when I stop running it as root?
Usually it needs to write to a folder owned by root, or listen on a low port. Change the folder's owner or use a port above 1024.
Avoid fixing it by returning to root.
How do I enforce non-root in Kubernetes?
Set runAsNonRoot: true in the security context and use admission policies that reject pods without it.
Pod Security Standards offer a ready-made profile for this. Reject any pod that does not set it, and review the exceptions.
Is rootless Docker ready for production?
It is supported and used, with some limits on networking and low ports. Check the current Docker documentation for what applies to your setup.
Many teams apply non-root users first, which is simpler.
Related
Terms that sit next to this one
Container escape
Breaking out of a container to reach the machine that hosts it.
Privileged container
A container given near-host powers, so a flaw inside it is a flaw in the host.
Least privilege
Giving every person and service the minimum access the job requires.
seccomp
A Linux feature that limits which system calls a container may make.
Distroless image
A minimal container image with no shell or package manager for an attacker to use.
What if the app is the way in?
Hardening limits the damage after a flaw is used, and it does not find the flaw. Cyberlop finds exploitable vulnerabilities in the running app and shows the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.