Container Security Posture

A read-only root filesystem refuses every write except into paths declared writable, so the renderer needs one mounted at its scratch directory and its temporary-file setting pointed there. Declare the size and the owning id too, or it breaks again.

Running as the superuser hands any code-execution bug full in-container privilege: it can rewrite the program files the running process reads, open every mounted credential regardless of ownership, and exploit whatever the boundary fails to close. An unprivileged, explicitly declared numeric id removes that head start.

Anything that can reach the runtime's control socket can ask it to create a privileged container with the host's filesystem mounted in, and the runtime obeys as a host-level process. No privilege inside the calling container is needed.

An admission gate runs after a workload spec is submitted and before the platform stores or schedules it. It reads the spec and the image reference the spec names, then admits the request or refuses it outright.

A call outside the allowlist is refused in the kernel before it runs, so the process gets an ordinary error return from deep inside a library. Most workloads only ever make the common calls a shipped default already permits.

The platform mints the job a short-lived token that names the workload itself, addressed to one audience and valid for minutes. The job presents it to the far service, which verifies the issuer's signature and grants only what that workload's grant allows.

Failing open admits unverified images exactly when nobody is watching. Failing closed admits nothing new, so rollouts, replacements and scale-ups stop while replicas already running keep serving. Shared clusters usually choose closed and then make it cheap.

A node credential belongs to the machine, so its grant must cover everything any workload placed there needs, and anything running on that host can reach it. A per-workload token names one workload and carries only that workload's access.

Sharing the host's process view exposes every process on the machine — their command lines, and their environment where the account allows it. Sharing the network view puts the container on the host's addresses, reaching services that only expected host-local callers.

Who the process is and what powers it holds are separate axes. Runtimes hand every container a default slice of superuser powers, held by the process rather than its account. Dropping them all and adding back only what is needed closes that second axis.

The build ran as the superuser, so the files it installed are owned by id 0 with bits that grant access only to that owner. At runtime the new id matches neither owner nor group and falls to the least-permissive bits. Fix ownership at build time.

They answer different questions. The allowlist decides which kernel calls may be attempted at all; the reachability profile decides which files and devices a call is allowed to touch. Widening one leaves the other exactly as it was.

Privileged mode, a writable host-root mount and the control socket are each already administrative access to that machine — one tier, where one grant is the whole loss. Narrow them to a read-only mount of the log directory.

An approved-source rule enforces where the bytes will be fetched from, not what the bytes are — it is a match on the reference string. Anyone able to publish under that host, or to copy a foreign image there, passes it.

Most often the syscall allowlist. A refused kernel call is returned to the caller as a plain permission error, so it surfaces as a library failure on an operation that has nothing to do with file permissions.

A short lifetime kills the whole class of credentials found later in an image, a log or a backup, because a captured copy is already dead. It does not limit use inside the window, anything traded for it, or an attacker still executing in the workload and reading each refreshed token.

Find what the gate is refusing first: an unapproved source, a missing verification result and a spec asking for privilege are three different problems. Then unblock the narrowest one, time-boxed — not the whole gate.

Require the request to name the refused call, not the wall. Then permit that one call in confinement scoped to that workload, with an owner, an expiry and a review — and treat switching the filter off as an exception, not the next rung down.

Three escape routes are grants written in the spec; the fourth is a defect in the shared kernel, reached by an ordinary call from inside the container. It needs no grant, appears in no spec, and a spec review cannot see it.

Images can ship program files marked to run with their owner's identity or extra powers rather than the caller's, so executing one raises privilege even from an unprivileged account. A declaration that forbids any privilege gain at exec blocks that, permanently and for every child.

Design around the one property that makes it survivable: held tokens stay valid to their own expiry, so an issuer outage degrades over one lifetime and hits newly started workloads first. Token lifetime is the lever, traded directly against a stolen token's window.