Rootless containers in Kubernetes environment

master's thesis

Anže Gorjan Novak (Author), Mojca Ciglarič (Mentor), Marcel Baunach (Mentor), Matjaž Pančur (Co-mentor), Michael Krisper (Co-mentor)

Abstract

In recent years, containerization has revolutionized the way software is developed, deployed, and managed, offering a lightweight alternative to traditional virtual machines. However, the traditional approach requires root privileges, which poses security challenges, as a container escape attack could compromise the entire host system. To address this, the rootless approach offers a promising alternative, eliminating the requirement for root-level access and thus enhancing security. With Kubernetes leading the way in containerized application orchestration, some Kubernetes distributions are beginning to implement this approach, running all components without root permissions. This thesis explores the concept and challenges of rootless container technology in Kubernetes, evaluating its maturity, performance, limitations, security implications, and potential applications. Through extensive benchmarking, we evaluate various aspects, including network, disk, and CPU performance in both rootless and rootful modes. Our findings reveal that while rootless Kubernetes significantly enhances security by minimizing the risk associated with container escape vulnerabilities, it does so at the expense of reduced network and disk performance. We also highlight the current limitations of rootless Kubernetes, such as its complexity, experimental nature, and the lack of multi-node cluster support, which currently limit its practical applications.

Keywords

rootless containers;Kubernetes;container security;computer science;master's thesis;

Data

Language:	English
Year of publishing:	2023
Typology:	2.09 - Master's Thesis
Organization:	UL FRI - Faculty of Computer and Information Science
Publisher:	[A. Gorjan Novak]
UDC:	004(043.2)
COBISS:	192115971
Views:	70
Downloads:	23
Average score:	0 (0 votes)
Metadata:

Other data

Secondary language:	Slovenian
Secondary title:	Vsebniki brez korenskega dostopa v okolju Kubernetes
Secondary abstract:	V zadnjih letih je tehnologija vsebnikov korenito spremenila način razvoja, nameščanja in upravljanja programske opreme ter ponudila lažjo alternativo tradicionalnim virtualnim računalnikom. Vendar pa tradicionalni pristop zahteva korenski dostop, kar predstavlja varnostne izzive, saj lahko napad za pridobitev dostopa do gostiteljskega sistema preko vsebnika ogrozi celoten gostiteljski sistem. Pristop brez korenskih pravic ponuja obetavno alternativo, saj odpravlja zahtevo po skrbniškem dostopu in s tem povečuje varnost. Ker je Kubernetes vodilni na področju orkestracije aplikacij v vsebnikih, so nekatere distribucije Kubernetes začele implementirati ta pristop, pri čemer se vse komponente izvajajo brez korenskih dovoljenj. To magistrsko delo raziskuje koncept in izzive tehnologije vsebnikov brez korenskega dostopa v sistemu Kubernetes ter ocenjuje njeno zrelost, zmogljivost, omejitve, varnostne posledice in potencialna področja uporabe. Z obsežno primerjalno analizo ocenjujemo različne vidike, vključno z zmogljivostjo omrežja, diska in procesorja, v načinih brez korenskega dostopa in s korenskim dostopom. Naše ugotovitve razkrivajo, da Kubernetes brez korenskega dostopa sicer bistveno poveča varnost, saj zmanjša tveganje, povezano z ranljivostmi pobega iz vsebnika, vendar to stori na račun zmanjšane zmogljivosti omrežja in diska. Izpostavljamo tudi trenutne omejitve sistema Kubernetes brez korenskega dostopa, kot so njegova zapletenost, eksperimentalna narava in pomanjkanje podpore za gruče z več vozlišči, ki trenutno omejujejo njegovo praktično uporabo.
Secondary keywords:	tehnologija vsebnikov;vsebniki brez korenskega dostopa;Kubernetes;varnost vsebnikov;magisteriji;Računalništvo;Univerzitetna in visokošolska dela;
Type (COBISS):	Master's thesis/paper
Study programme:	1000471
Embargo end date (OpenAIRE):	1970-01-01
Thesis comment:	Univ. v Ljubljani, Fak. za računalništvo in informatiko
Pages:	X, 104 str.
ID:	23281778