14

I have two unprivileged containers and I'd like to share a unix socket between them. Each container has its own user on the host, complete with separate subuid and subguid mappings.

I've tried creating groups in the containers and mapping them to one group on the host. However, this doesn't work. I'd prefer not to create additional users, to keep the number of users involved and potential security leaks as small as possible, without exposing the containers to one another.

2
  • Is this using file-name namespace? If so then this becomes a file sharing question.
    – ctrl-alt-delor
    Jan 5, 2021 at 13:21
  • If the software that make use of the unix socket allows it, it could be a good idea to consider using TCP/IP communications instead of Unix sockets. That totally make sense as, given the level of isolation choosen, your container seems more like a separated host than a separated process group ;-)
    – binarym
    Mar 12, 2021 at 9:37

1 Answer 1

Reset to default
1

Unix sockets behave exactly like IP sockets with exception of address which is a file path. All it takes is for the containers to see the socket address = file path. UID permission is not checked. I haven't tried it (I explain reason in a moment) but sharing mount namespace should be sufficient; if not then maybe IPC ?

Maybe you mean named pipes ? UID access is checked for named pipes but you can use file access control list to allow access from mapped users

mkfifo abc; setfacl -m u:12345:rw abc; setfacl -m u:23456:rw abc

Reason it does not make sense to use unix sockets is that they are not noticeably faster or more secure than IP sockets. So real question is why do you need unix sockets for communication ?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .