Running a container as root is dangerous. But why? Let's first understand what the difference is between running a process as root in a container vs running containers as root. Then, let's see in practice the extent of a compromise when a program inside a root container has the ImageTragick bug.
The article discusses the security risks of running processes and containers as root in Docker, differentiating between the two scenarios and offering solutions like Docker's Rootless feature to mitigate these risks.
Let’s head to the lab to discover, debug, and fix this vulnerability within an actual application.
Containers, protected by kernel features like cgroup and tools like AppArmor, do not offer the same protection as virtual machines. A compromised process in a container can be devastating, and since Docker engine and images often lack secure default settings, it is essential to take time to harden them.
