2.9 KiB
title, description, weight
| title | description | weight |
|---|---|---|
| Security & privilege isolation | Security measures, privilege isolation, and project-level sandboxing. | 20 |
Security in Root is achieved through strict privilege isolation and project-level "sandboxing" to mitigate the impact of service compromises.
The "No-Root" Principle
Running applications as root inside containers is a significant security risk. The framework enforces isolation via the tiers/useradd and tiers/chown actions.
Project-specific users
Every project located at {repository root}/{node}/{project} is assigned a dedicated system user on the host.
- Isolation: If a container is compromised, the attacker only gains the privileges of that specific low-privileged user.
- Filesystem safety: Projects can only read/write to their own directories within the Tiers.
Docker socket protection
Direct access to /var/run/docker.sock is equivalent to root access on the host. As a best practice, it is highly recommended to protect the Docker socket. One way to achieve this is by utilizing a Socket Proxy (e.g., based on tecnativa/docker-socket-proxy) to filter and restrict access to the Docker API.
services:
socket-proxy:
image: tecnativa/docker-socket-proxy:0
container_name: root-socket-proxy
user: "0:0"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
environment:
CONTAINERS: 1
SERVICES: 1
TASKS: 1
networks:
socket: {}
restart: unless-stopped
traefik:
# ...
depends_on:
- socket-proxy
command:
# Use the proxy instead of the local socket
- "--providers.docker.endpoint=tcp://root-socket-proxy:2375"
networks:
socket: {}
Security Monitoring (CrowdSec)
The framework integrates CrowdSec for behavioral detection and automated response.
- Intrusion detection: CrowdSec monitors logs from Traefik and SSH for suspicious patterns (e.g., brute-force attacks, port scanning).
- Automated blocking: When a threat is detected, the CrowdSec Firewall Bouncer automatically updates UFW rules to block the malicious IP at the host level.
- Shared threat intelligence: CrowdSec shares anonymized threat data with its community, providing preemptive protection against known bad actors.
Network hardening
Root uses configure/ufw to implement a "Default Deny" policy.
- Internal routing: Services communicate over a dedicated
root-proxybridge network, which is often configured asinternal: true. - Enclave isolation: Outgoing traffic can be routed through a dedicated egress node for granular control.
See also: