Talk:Podman: Difference between revisions
Latest comment: 14 October by Miike in topic The “rootless” example gives root access
m →Missing `virtualisation.podman.dockerSocket.enable`: formatting |
→The “rootless” example gives root access: new section |
||
| Line 2: | Line 2: | ||
Missing <code>virtualisation.podman.dockerSocket.enable</code> [[User:Malix|Malix]] ([[User talk:Malix|talk]]) 19:39, 30 November 2025 (UTC) | Missing <code>virtualisation.podman.dockerSocket.enable</code> [[User:Malix|Malix]] ([[User talk:Malix|talk]]) 19:39, 30 November 2025 (UTC) | ||
== The “rootless” example gives root access == | |||
The <code>nginx-rootless</code> user gets <code>extraGroups = [ "podman" ]</code>. Rootless Podman doesn’t need that group at all. The NixOS module always enables the rootful <code>podman.socket</code> (wanted by <code>sockets.target</code>) with <code>SocketGroup = "podman"</code>. So any member of the group can drive the root Podman API, whether or not <code>dockerSocket.enable</code> is set. That cancels out the whole point of the section, since a compromised container user can escalate to root. The line should be removed. [[User:Miike|Miike]] ([[User talk:Miike|talk]]) 07:17, 14 October 2026 (UTC) | |||
Revision as of 07:17, 14 October 2026
Missing `virtualisation.podman.dockerSocket.enable`
Missing virtualisation.podman.dockerSocket.enable Malix (talk) 19:39, 30 November 2025 (UTC)
The “rootless” example gives root access
The nginx-rootless user gets extraGroups = [ "podman" ]. Rootless Podman doesn’t need that group at all. The NixOS module always enables the rootful podman.socket (wanted by sockets.target) with SocketGroup = "podman". So any member of the group can drive the root Podman API, whether or not dockerSocket.enable is set. That cancels out the whole point of the section, since a compromised container user can escalate to root. The line should be removed. Miike (talk) 07:17, 14 October 2026 (UTC)