Here's why podman is more secured than Docker - DevSecOps
Tags: docker, devops, security, linux
Published: 2019-10-10 16:31:27

---
title: Here's why podman is more secured than Docker - DevSecOps
published: true
description: Here's why podman is more secured than Docker - DevSecOps
tags: docker,devops,security,linux
canonical_url : https://cloudnweb.dev/2019/10/heres-why-podman-is-more-secured-than-docker-devsecops/
---
<!-- wp:paragraph -->
<p>Here's why <a href="https://cloudnweb.dev/2019/06/replacing-docker-with-podman-power-of-podman/">podman </a>is more secured than Docker - DevSecOps</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>We all know that <a href="https://click.linksynergy.com/link?id=YIJ5oggSvpI&amp;offerid=507388.1793828&amp;type=2&amp;murl=https%3A%2F%2Fwww.udemy.com%2Fcourse%2Fdocker-and-kubernetes-the-complete-guide%2F">Docker </a>is one of the popular tool for containerizing an application in devops world.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>but, In this article we will see about podman and why it is more secured way to run container.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p> Podman is a daemonless container engine for developing,managing and running container in linux system.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":773,"align":"center"} -->
<div class="wp-block-image"><figure class="aligncenter"><img src="https://cloudnweb.dev/wp-content/uploads/2019/06/podman_flow.png" alt="" class="wp-image-773"/></figure></div>
<!-- /wp:image -->

<!-- wp:heading {"level":3} -->
<h3>Audit Logging</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Linux system stores the user account information in a file called <strong>/etc/shadow</strong>. it is a common security file to watch in a linux systems.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Linux kernel allows administrators to watch for the processes that modifies the file and keep a record of it in <strong>audit.log</strong>. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>administrators wants to know if any process modifies the file from the log.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>auditctl -w /etc/shadow</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>this command will add the <strong>/etc/shadow</strong> file to the audit system.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>let's modify the <strong>/etc/shadow</strong> file and see what happens</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>touch /etc/shadow</code></pre>
<!-- /wp:code -->

<!-- wp:code -->
<pre class="wp-block-code"><code>ausearch -f /etc/shadow -i -ts recent</code></pre>
<!-- /wp:code -->

<!-- wp:image {"id":1501,"align":"center","width":948,"height":103} -->
<div class="wp-block-image"><figure class="aligncenter is-resized"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/Screenshot-2019-10-09-at-12.08.35-AM-1024x112.png" alt="" class="wp-image-1501" width="948" height="103"/></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>audit record will show lots of information about the process and owner of the process <strong>audit UID</strong>(auid) who modified the<strong> /etc/shadow</strong> file</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3>Login UID in linux kernel</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>there  is a file called loginuid stored in <strong>/proc/self/loginuid</strong>. this file is a part of proc structure in linux. this file can be set only <a href="https://unix.stackexchange.com/questions/146138/loginuid-should-be-allowed-to-change-or-not-mutable-or-not">once</a>.  </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>after it is set, the kernel will not allow any process to reset it. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p> When I log into the system, the login program sets the loginuid field for my login process. </p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1502,"width":958,"height":50} -->
<figure class="wp-block-image is-resized"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/Screenshot-2019-10-09-at-12.32.48-AM-1024x53.png" alt="" class="wp-image-1502" width="958" height="50"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>My UID was  <strong>1000</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Even if i change to root, my loginUID will be the same. <strong>1000</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Important thing to note here is that every process that <strong>fork and execute</strong> from the initial process will have the same loginuid.that is how kernel knew about the user information.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3>How it works in containers</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>let's try to run the same process in podman and docker containers</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1503,"width":941,"height":180} -->
<figure class="wp-block-image is-resized"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/Screenshot-2019-10-09-at-1.14.48-AM-1024x196.png" alt="" class="wp-image-1503" width="941" height="180"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Now, we will check it with docker</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1504,"width":943,"height":143} -->
<figure class="wp-block-image is-resized"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/Screenshot-2019-10-09-at-1.20.31-AM-1024x156.png" alt="" class="wp-image-1504" width="943" height="143"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Hmm, Interesting... why is the loginuid is different for docker and same for podman. </p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3>The Reason</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>So, if you remember carefully. i said some important keyword called <strong><a href="https://www.bottomupcs.com/fork_and_exec.xhtml">fork and execute</a></strong>. let's discuss about it here . </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>podman uses a fork/exec model for the container, So the container process is the child of podman process. whereas, docker uses a client/server model.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1505,"align":"center"} -->
<div class="wp-block-image"><figure class="aligncenter"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/docker_cs.png" alt="" class="wp-image-1505"/></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>docker uses a cli which communicates with docker daemon via a client/server operation. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Then the docker daemon creates a container and handles communications of <strong>stdin/stdou</strong>t back to the docker client tools.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>So the default loginuid of podman container still the same(<strong>1000</strong>) whereas, docker default loginid of processes(before their loginuid is set) is <strong>4294967295</strong>. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Since the container is an child of the docker daemon and docker daemon is the child of init system.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3> What could go wrong? </h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Let's see what happens if a container process created by docker modifies the <strong>/etc/shadow</strong> file.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1506,"width":927,"height":140} -->
<figure class="wp-block-image is-resized"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/Screenshot-2019-10-09-at-1.20.31-AM-1-1024x156.png" alt="" class="wp-image-1506" width="927" height="140"/></figure>
<!-- /wp:image -->

<!-- wp:image {"id":1507,"width":924,"height":136} -->
<figure class="wp-block-image is-resized"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/Screenshot-2019-10-09-at-1.20.38-AM-1024x151.png" alt="" class="wp-image-1507" width="924" height="136"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>you can see the uid as <strong>unset </strong>in the case of docker. this means the administrator will know that the<strong> /etc/shado</strong>w is modified . but, admin will never know who modified that file.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>if that hacker removes the docker container, then there would be no trace on the system of who modified the /etc/shadow file.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Now, Let's look at the exact same scenario for Podman.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>sudo podman run --privileged -v /:/host fedora touch /host/etc/shadow</code></pre>
<!-- /wp:code -->

<!-- wp:code -->
<pre class="wp-block-code"><code>sudo ausearch -f /etc/shadow -i</code></pre>
<!-- /wp:code -->

<!-- wp:image {"id":1508,"width":921,"height":100} -->
<figure class="wp-block-image is-resized"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/Screenshot-2019-10-09-at-12.08.35-AM-1-1024x112.png" alt="" class="wp-image-1508" width="921" height="100"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Podman records the process which modifies the file correctly since it uses traditional fork/exec model.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p> Here's why podman is more secured than Docker - DevSecOps. Using Podman for launching containers allows you to maintain better security though audit logging.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>  The auditing system is&nbsp;very powerful for watching what processes do on a system. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Reference : <a href="https://opensource.com/article/18/10/podman-more-secure-way-run-containers">https://opensource.com/article/18/10/podman-more-secure-way-run-containers</a></p>
<!-- /wp:paragraph -->

<!-- wp:html -->
<a href="https://click.linksynergy.com/link?id=YIJ5oggSvpI&offerid=507388.1587718&type=2&murl=https%3A%2F%2Fwww.udemy.com%2Fcourse%2Fadvanced-node-for-developers%2F"><IMG border=0 src="https://i.udemycdn.com/course/480x270/1587718_8fdf.jpg" ></a><IMG border=0 width=1 height=1 src="https://ad.linksynergy.com/fs-bin/show?id=YIJ5oggSvpI&bids=507388.1587718&type=2&subid=0" >
<!-- /wp:html -->