Container Linux on the Desktop
Or How I Over Engineered My Laptop
I am Jess
2
I have contributed to many
open source projects including
Docker, Go, Kubernetes,
Runc, & the Linux kernel
3
Content Warning for the rest of this talk
DO NOT TRY THIS AT HOME
Content Warning for the rest of this talk
No really, don’t
Content Warning for the rest of this talk
I mean it….
Content Warning for the rest of this talk
And if you do,
DO NOT COME TO ME FOR SUPPORT
I have done some things with containers.
I containerized my closet.
How this all started...
October 2014…
Young Jess
Things I have demoed in containers...
This is all fine and dandy but can we build a secure OS from it....
Secure OS Base - CoreOS Container Linux
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
I also have a thing for sandboxes...
16
What is a sandbox?
17
18
Provides a net reduction in attack surface.
19
Compare code execution from inside and outside the sandbox...
Are more or less things possible now?
20
Compare code execution from inside and outside the sandbox...
Are more or less things possible now?
21
Chrome Sandbox
22
Each tab gets its own pid namespace.
23
What’s a pid namespace?
Used to isolate the process ID number space.
24
Also uses unprivileged user namespaces and network namespaces.
25
Uses Seccomp-BPF
26
27
What is Seccomp?
28
SECure COMPuting with filters
29
Allows developers to write BPF programs that determine whether a given system call will be allowed or not.
30
What is BPF?
Berkeley Packet Filter
In-kernel bytecode machine that is used for tracing, virtual networks, seccomp… and more.
31
Let’s apply these same principles to containers...
Docker's default seccomp profile is a whitelist which specifies the calls that are allowed.
34
It blocks a bunch of bad stuff…
(not limited to the following)
35
add_key
keyctl
request_key
Prevent containers from using the kernel keyring, which is not namespaced.
36
clone
Deny cloning new namespaces.
Also gated by CAP_SYS_ADMIN for CLONE_* flags, except CLONE_USERNS, which is a big one to block by default :D
37
unshare
Deny cloning new namespaces for processes. Also gated by CAP_SYS_ADMIN, with the exception of unshare --user.
38
In making this default seccomp profile I broke my desktop...
Running Chrome in a container requires a custom profile because of this...
Remaining
Problems
docker daemon runs as root
Mad props to Aleksa Sarai because that patch took over a year to merge.
Working with runc...
Previous I used docker for my containers so I had to convert all the configs...
And what about networking...
So at this point we...
Have ability to sandbox desktop apps by running them in containers
Can run the containers _not_ as root to eliminate needing privileges
CoreOS Container Linux
51
read-only /usr and stateful read/write /
Forces the use of containers.
Auto-updates
(If I wanted to host my own Omaha server which I am not that crazy yet)
Trusted Computing with TPM
dm-verity
I get all these things out of the box by using Container Linux as an OS base.
Just had to add graphics drivers.
Emerge all the way down :)
Building Container Linux
60
Repos all the way down
scripts
Build and maintenance scripts.
init
Init system unit files and config files.
coreos-overlay
Portage overlay for specific coreos packages, custom ebuilds.
manifest
Configuration files for pulling all the repos together. Used by repo tool.
Pretty much the ultimate source of truth.
manifest
<project path="src/platform/factory-utils"
name="chromiumos/platform/factory-utils"
groups="minilayout" remote="cros" />
�
<project path="src/scripts"
name="jessfraz/scripts"
revision="desktop"
groups="minilayout" />
�
<project path="src/third_party/portage-stable"
name="jessfraz/portage-stable"
revision="desktop"
groups="minilayout" />
�
<project path="src/third_party/coreos-overlay"
name="jessfraz/coreos-overlay"
revision="desktop"
groups="minilayout" />
baselayout
Base Container Linux filesystem layout and configs.
portage-stable
Mirror of ebuilds from portage tree.
mantle
Tool to build Container Linux images. Uses a chroot, super nice to use.
Image Building Pipeline
70
I run everything in containers...
So you can imagine I have quite a few container images...
Secure OS Base - CoreOS Container Linux
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
Secure OS Base - CoreOS Container Linux
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
git push & cron
Secure OS Base - CoreOS Container Linux
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
Jenkins CI
git push & cron
Secure OS Base - CoreOS Container Linux
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
Jenkins CI
git push & cron
build , push, and sign images
Secure OS Base - CoreOS Container Linux
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
Jenkins CI
git push & cron
build , push, and sign images
scans image for vulns
So now we have...
Secure OS Base - CoreOS Container Linux
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
rootless app container with seccomp
Oh btw this entire talk has been running on Container Linux ;)
In a rootless container with a seccomp filter.
Thank you!
@jessfraz