Talk:Podman: Difference between revisions
→The “rootless” example gives root access: new section |
No edit summary |
||
| Line 5: | Line 5: | ||
== The “rootless” example gives root access == | == The “rootless” example gives root access == | ||
The <code>nginx-rootless</code> user gets <code>extraGroups = [ "podman" ]</code>. Rootless Podman doesn’t need that group at all. The NixOS module always enables the rootful <code>podman.socket</code> (wanted by <code>sockets.target</code>) with <code>SocketGroup = "podman"</code>. So any member of the group can drive the root Podman API, whether or not <code>dockerSocket.enable</code> is set. That cancels out the whole point of the section, since a compromised container user can escalate to root. The line should be removed. [[User:Miike|Miike]] ([[User talk:Miike|talk]]) 07:17, 14 October 2026 (UTC) | The <code>nginx-rootless</code> user gets <code>extraGroups = [ "podman" ]</code>. Rootless Podman doesn’t need that group at all. The NixOS module always enables the rootful <code>podman.socket</code> (wanted by <code>sockets.target</code>) with <code>SocketGroup = "podman"</code>. So any member of the group can drive the root Podman API, whether or not <code>dockerSocket.enable</code> is set. That cancels out the whole point of the section, since a compromised container user can escalate to root. The line should be removed. | ||
The Setup section does the same thing by default. It adds the user to podman unconditionally, then says “consider using rootless podman.” The warning itself is accurate; it matches the module’s own option description. But the example should leave the group out and add it only for people who need the rootful socket, such as Docker-API tools. | |||
[[User:Miike|Miike]] ([[User talk:Miike|talk]]) 07:17, 14 October 2026 (UTC) | |||
Revision as of 07:18, 14 October 2026
Missing `virtualisation.podman.dockerSocket.enable`
Missing virtualisation.podman.dockerSocket.enable Malix (talk) 19:39, 30 November 2025 (UTC)
The “rootless” example gives root access
The nginx-rootless user gets extraGroups = [ "podman" ]. Rootless Podman doesn’t need that group at all. The NixOS module always enables the rootful podman.socket (wanted by sockets.target) with SocketGroup = "podman". So any member of the group can drive the root Podman API, whether or not dockerSocket.enable is set. That cancels out the whole point of the section, since a compromised container user can escalate to root. The line should be removed.
The Setup section does the same thing by default. It adds the user to podman unconditionally, then says “consider using rootless podman.” The warning itself is accurate; it matches the module’s own option description. But the example should leave the group out and add it only for people who need the rootful socket, such as Docker-API tools.