Towards unprivileged container builds
summary
Goal: build container images inside Kubernetes pods without host root or extra privileges. Uses user namespaces to map root-in-container to non-root on host, then creates inner namespaces to pivot/chroot and run builds. Major blockers: overlayfs in userns is not supported upstream (Ubuntu has patches) and mounting /proc/sys hides protected mounts; fuse support landing in kernel 4.18 helps daemonless mounts. Result: feasible today with distro patches or granting limited caps, but not universally deployable yet.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:51Build before continuous
- 2:14Build without privilege
- 7:18Build with privilege
- 9:12User name space
- 13:56Other options
- 15:30Overlay FS
- 18:07Profile system
related talks
44mRootless containers
42mSecuring Filesystem Images for Unprivileged Containers
34mUnprivileged Image Builds: What are the Challenges and Where are we Today?
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
01h 31mTutorial: Using Linux Primitives to Build Your Own Containers
14mcontainerd: Rootless Containers 2020
47mLinux user namespaces: a blessing and a curse
30mThe Route To Rootless Containers