February 2021
Beginner to intermediate
252 pages
5h 36m
Korean
Content preview from 컨테이너 보안: 컨테이너화된 응용 프로그램의 보안을 위한 개념, 이론, 대응법과 모범 관행까지
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
제
9
장
컨테이너 격리 깨기
164
$ sudo runc run sh
/ $ whoami
whoami: unknown uid 5000
/ $ sleep 100
sudo
를 이용해서
runc
를 루트로 실행했지만, 컨테이너의 사용자
ID
는 앞에서 설정한
5000
이
다. 호스트에서도 이 점을 확인할 수 있다.
$ ps -fC sleep
UID PID PPID C STIME TTY TIME CMD
5000 26909 26893 0 16:16 pts/0 00:00:00 sleep 50
제
6
장에서 보았듯이
OCI
표준을 준수하는 이미지 번들은 이미지를 위한 루트 파일 시스템
과 런타임 설정 정보로 이루어진다. 그 런타임 설정 정보가 도커용 이미지에 들어간다. 도커에
서는 다음과 같이
--
user
옵션으로 런타임 설정 정보에 있는 사용자
ID
가 아닌 다른 사용자
ID
를 명시적으로 지정할 수 있다.
$ docker run -it --user 5000 ubuntu bash
I have no name!@b7ca6ec82aa4:/$
그리고 이미지에 포함되는 사용자
ID
정보는
Dockerfile
파일에서
USER
명령으로 지정할 수
있다. 그러나 공용 레지스트리들에 있는 컨테이너 이미지들은 대부분 그런
USER
명령 없이 만
들어졌으며, 특별히 사용자
ID
를 지정하지 않으면 컨테이너는
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.