SITE ONLINE HOST: www.linuxadmin.work EDITION: 2026-10-10
linuxadmin.work · safety-first operations manual
linuxadmin.work Linux administration manual · v.2026-10-10

Chapter 8 — Containers

Containers are not VMs and do not erase host privilege. Docker's daemon is root-privileged by default, and users able to control it can mount host paths into containers; Podman documents rootless operation, capabilities, mounts, and security labels (Docker Engine security; Podman overview; Podman run). Treat membership in the Docker control group / socket access as privileged access — the practical consequence is that a "container user" with docker access is effectively root on the host.

HIGH-RISK — privileged containers and host mounts. Writable host binds expose host files to the container; --privileged, host PID/network namespaces, device passthrough, excess capabilities, or an unauthenticated remote daemon API expand impact further (Docker Engine security). Preflight: identify exactly which host paths, devices, capabilities, and namespaces the workload needs. Rollback: container config in version control. Success check: the app runs with its needed access and no more.

The Podman run manual states that adding capabilities increases container privilege and highlights CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_MKNOD, and CAP_SYS_MODULE as particularly dangerous outside a user namespace; it also documents volume relabel options (:z shared / :Z private semantics) for SELinux-aware setups — avoid recursive relabeling of shared host data without understanding the effects (Podman run).

A minimum container baseline (Docker Engine security; Podman docs):

  • trust and pin image sources/versions;
  • avoid privileged mode and broad host mounts;
  • run application processes non-root; prefer rootless engines where feasible;
  • limit capabilities and resources;
  • isolate management APIs (restrict who may reach the daemon/socket);
  • maintain security profiles (SELinux/AppArmor integration);
  • include volumes and container configuration in backup/restore drills (Chapter 6).

Docker and Podman both expose controls, but their daemon/rootless architecture and defaults differ — specify the engine in procedures, and confirm installed versions before copying examples (Docker Engine security; Podman overview).