Which Php-FPM is more secure? Rootless Docker Vs. AppArmor

dragonsway · March 9, 2022, 3:26am

Here, I go again… asking about security…

I have a dilemma and someone with a bit more experience might be able to smack me straight.

If I run my apps the traditional way (without containerizing them) I can run AppArmor to help protect my services like php-fpm and I don’t have to give virtual server users sudo privileges.

However, if I run Docker-Rootless, according to documentation the “rootless” version of docker doesn’t support AppArmor, SELinux, etc. and I have to add the virtual server user to the “docker” group, which itself has root privileges.

Overall, docker containers are suppose to be super secure… and docker / podman /devops is clearly the future of everything. I’d rather install all of my apps using docker containers as to eliminate the headache of test / prod functional problems of applications…

However, I am worried that without AppArmor & adding virtual servers users to the docker group, that I would be foolishly trading security for convenience.

How safe is it to run docker-rootless on production servers?

Or am I misunderstanding something… and I can still run AppArmor in conjunction with docker-rootless?

tpnsolutions · March 9, 2022, 1:17pm

@dragonsway,

The following thread on GitHub may be of interest to you, and perhaps you can share your experiences there as they seem to be covering your issue regarding “Rootless-Docker” and “AppArmor”.

github.com/moby/moby

AppArmor support for Rootless Docker

opened 09:52AM - 26 Jan 21 UTC

mstmob

area/security/apparmor kind/enhancement area/rootless

**Description** Currently AppArmor is not supported for rootless docker ([Known… Limitations](https://docs.docker.com/engine/security/rootless/#known-limitations)). I know that loading a new profile via `apparmor_parser` is restricted for a normal user. For this reason the rootless daemon could not load a AppArmor profile at runtime such as the `docker-default` profile. However I do not see a reason why a manually added and loaded profile can not be applied for a Docker container i.e. via `--security-opt 'apparmor=custom-profile'`. Is there a specific reason restricting AppArmor for the rootless docker mode? **Workaround** I already have success with the following workaround, so technically the daemon could support manually loaded AppArmor profiles IMO. 1. Prerequisite Load custom profile in enforce mode as root: ```sh sudo apparmor_parser -Wr /etc/apparmor.d/docker-custom ``` 2. Manually apply AppArmor profile inside a rootless docker container ```sh docker exec -it ubuntu /bin/bash # inside container echo "exec docker-custom" > /proc/self/attr/exec # start new process bash # this process is now enforced by apparmor ``` **Describe the results you expected** I would expect that the same behavior as the workaround is archived by simply setting the `--security-opt 'apparmor=custom-profile'` flag on container startup. **Output of `docker version`:** ``` Docker version 20.10.1, build 831ebea ```

dragonsway · March 9, 2022, 1:31pm

@tpnsolutions
Thanks for the lead… I will check it out. While I am here, I want to accept a little egg on my face and correct an earlier statement.

The above is incorrect. If anyone is interested you can install the docker-rootless daemon as a non-sudo user and install docker-compose -without- adding the non-sudo user to a docker group. The installation is a little tricky because apparently no one in the world runs rootless docker on ubuntu except me…

If anyone is interested, I tinkered 'til I got it…

First install the docker-rootless daemon according to documentation, very easy.

Then install docker compose

mkdir -p ~/.docker/cli-plugins/
curl -SL https://github.com/docker/compose/releases/download/v2.2.3/docker-compose-linux-x86_64 -o ~/.docker/cli-plugins/docker-compose
chmod +x ~/.docker/cli-plugins/docker-compose

And verify successful installation with:

$ docker compose version
Docker Compose version v2.2.3

whatever you do… DO NOT USE $ docker-compose up -d you will get errors. You should use docker compose up -d if you are running version 2 or greater

Also, be sure to add this to your non-sudo user’s .bashrc

export PATH=/usr/bin:$PATH
export DOCKER_HOST=unix:///run/user/xxx/docker.sock

system · June 19, 2022, 4:28pm

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.