Add option to turn off userns=host configuration.

[KristofKuli]

Description

We are using no-privilege-root plugin to protect our Docker configuration, which doesn't allow to use userns as host. Due to this, our customer can only use Pack CLI version, which is older than 0.35.0.

Proposed solution

A switch or flag could be added to the "pack" command, allowing the user to decide, which mode to be used.

Describe alternatives you've considered

Additional context

• This feature should be documented somewhere

[jjbustamante]

Hi @KristofKuli , could you elaborate a little bit more about the issue? Maybe some example on the Docker Configuration, and the expected behavior you want from pack?

[KristofKuli]

Hi @jjbustamante,

In our company, we are using no-trivial-root plugin for Docker, which prevents the userns usage in "host" mode. This has been enabled in pack cli v0.35.0, therefore we are unable to use the newer versions. We would like to request an option for the pack command, which would allow us to turn off the host mode.

[KristofKuli]

Hi @jjbustamante,

Is there any update on this?

Regards,
Kristof

[zioalex]

HI there,
we are in the same situation.
For security reasons we don't want to share the runner name space with the containers.
Is there any viable alternative to such configuration?.
Thanks
Alex

[jjbustamante]

Hi @KristofKuli , @zioalex. I will bring this issue to the next WG meeting. We added the userns=host as part of a security review, and I want to be clear on the implications.

[jjbustamante]

@KristofKuli @zioalex we discussed about this issue in our working group meeting, the reason I've been waiting on this issue is because when we added the userns=host configuration, it was to fix a security vulnerability found by a third-party expert.
Reading on what userns=host and no-trivial-root do, I understand both of them can't coexist, and the logical approach is to provide some flag to disable it.

But I want to get some 👀 to validate if adding userns=host was a good decision on our end.

• @BarDweller, you implemented a Java platform, and I know you deal with permissions issues. Do you have thoughts here?
• @jkutner , @hone , @natalieparellano even @sambhav , can I get your thoughts on:
  • Did we make pack more secure for end-users by adding userns=host? Make sense to keep it and add the flag for end-users to disable it, because, like this case, they are using something else?

[BarDweller]

I'd just say that the use of this flag isn't in the platform spec, and the snowdrop platform impl doesn't use it. It sounds a bit like the podman rootless operation where ids within a container are mapped outwards, so you can have things like root in a container being the invoking user outside..

Sticking around to read why pack is doing this, in case it's worth adding to the snowdrop impl =)

[jjbustamante]

@KristofKuli @zioalex , after some internal discussion, we agreed on:

• Adding userns=host was probably not the best decision from our side, even though it was recommended during the security review.
• Reverting default pack behavior to not use userns=host by default, I mean, reverting to behavior prior 0.35.0 release
• We will add a flag, but in this case, it will be to turn on userns=host

Thanks for reporting this. I think after the behavior is reverted, you will not have a problem with the plugin you are using.

[KristofKuli]

Hi @jjbustamante!

Thank you for following up on this topic. Once the the new version is released, we will give you a feedback.