I'm not extremely familiar with systems programming or operating systems, so this is probably a stupid question. But I was trying to get a game running in Wine recently that implements an anti-cheat system. After much frustration I learned that it wasn't possible because the anti-cheat system needs to run in kernel mode ("ring 0"?) and Wine runs in user mode ("ring 3"?)

There are plenty of posts about the differences between ring 0 and ring 3, or why Wine runs in one instead of the other. For instance: Why does wine not support kernel mode driver?

However when I thought about it, the problem felt oddly familiar to the one being solved by container solutions like Docker. Would Wine, running inside of Docker, not be able to provide ring 0 access safely? Or can Docker only run user mode programs? Why does an entire CPU need to be emulated when you can just utilize containers to prevent malicious programs from going ham on your machine?

  • Wine is not a virtual machine, not even close. It arguably IS an emulator despite its name. The anti-cheat program is a windows device driver if it runs in kernel mode, not part or the (user mode) game. Your only option is to run the game using something like VirtualBox under a legit copy of windows. EDIT.. @user431397 points out truth.. there are ALWAYS ways around an anti-cheat ;^) – Señor CMasMas Sep 22 '20 at 19:32
  • x86 ring 0 = supervisor mode = kernel mode
  • x86 ring 3 = user mode

Docker containers and the docker daemon run in user mode. The containers share the kernel with the host system. Docker uses new features in the kernel, in the same way that other programs use old features in the kernel.

If you run code in supervisor mode, then it runs in the kernel, and has god powers over all of your processes and data.

However you can run code in virtual supervisor mode (using virtual box or other visualisers). For this you put the whole system, in the virtual machine, not just the user mode parts. Therefore you can add kernel mode code.

Note carefully: If you install kernel mode code, then it has TOTAL control of your machine. It can see everything that you do, and control your machine to do what ever it wants.

  • You have described at a high level how the rings work with Docker and how to run non-device code in the kernel. You are clearly quite bright. This is all completely irrelevant to the question he asked with the exception that he asked "what about docker?" – Señor CMasMas Sep 22 '20 at 19:32
  • 1
    @SeñorCMasMas Some may not be relevant (I added more that needed), but some answer the question. As for bright, no I have just been doing this stuff for a while. – ctrl-alt-delor Sep 22 '20 at 19:36
  • 1
    @SeñorCMasMas Actually my original question was "in a container" -- I was specifically curious about Docker (or other container solutions) as I knew these provided a level of separation between processes so I thought they would enable the running of kernel mode code on a "virtual" environment. I wasn't aware that Docker actually ran in user mode. – stevendesu Sep 22 '20 at 19:50
  • Fair enough and fair enough. I should READ better. :^P Sorry guys. – Señor CMasMas Sep 22 '20 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.