https://linuxeries.org/tags/rootless/ Recent content in Rootless on ShieldedBytes Hugo en Sat, 24 Oct 2026 10:12:15 +0200 https://linuxeries.org/post/2026-10-24-how-to-stop-dockercompatible-containers-from-/ Sat, 24 Oct 2026 10:12:15 +0200 https://linuxeries.org/post/2026-10-24-how-to-stop-dockercompatible-containers-from-/ <h2 id="why-rootless-containers-still-need-guardrails">Why Rootless Containers Still Need Guardrails</h2> <p>Running containers as a non‑root user is a solid first line of defense, but it’s not a silver bullet. A mis‑configured image, a vulnerable app, or a simple oversight can still let a container touch <code>/etc</code>, <code>/var</code>, or even your own home directory. This post walks through the hardening steps that keep file writes strictly inside a rootless runtime’s writable layer.</p> <hr> <h3 id="1-the-rootless-model-in-2026">1. The Rootless Model in 2026</h3> <p>Rootless mode is all about user namespaces. The container’s root (<code>uid 0</code>) gets mapped to a non‑root UID on the host, and the kernel enforces that the process can only see files that belong to that UID. The catch is that the mapping is <em>per‑process</em>, not per‑filesystem. If a container mounts a host directory or a volume, the process inside can write to it unless the mount options explicitly deny it.</p>