CME-703
Rootless Containers
Description
Containers run entirely without root privileges on the host. The container runtime, image pull, and all container processes run as an unprivileged user, eliminating host-level root compromise from container escape.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Scope (S) | C → U | Container escape lands as unprivileged host user, not root |
| Privileges Required (PR) | L → H | Even root inside container is unprivileged on host |
CWE Relationships
Verification
Verify podman/docker running rootless
$ podman info | grep rootless
# Expected: rootless: true
# Expected: rootless: true
Platform: linux
$ podman info --format '{{.Host.Security.Rootless}}'
# Expected: true
# Expected: true
Platform: linux
$ ps -eo user,comm | grep -E 'conmon|crun|runc' | grep -vc root
# Expected: >=1 (container runtime processes running as non-root)
# Expected: >=1 (container runtime processes running as non-root)
Platform: linux
$ grep -c '<username>' /etc/subuid
# Expected: 1 (subordinate UIDs allocated for rootless user)
# Expected: 1 (subordinate UIDs allocated for rootless user)
Platform: linux
Remediation
linux
Podman rootless container setup with subordinate UID/GID allocation
usermod --add-subuids 100000-165535 --add-subgids 100000-165535 <username>
loginctl enable-linger <username>
su - <username> -c 'podman system migrate'