72 lines
2.9 KiB
Markdown
72 lines
2.9 KiB
Markdown
---
|
|
title: Security & privilege isolation
|
|
description: Security measures, privilege isolation, and project-level sandboxing.
|
|
weight: 20
|
|
---
|
|
|
|
Security in Root is achieved through strict privilege isolation and project-level "sandboxing" to mitigate the impact of service compromises.
|
|
|
|
## The "No-Root" Principle {#noroot}
|
|
|
|
Running applications as `root` inside containers is a significant security risk. The framework enforces isolation via the `tiers/useradd` and `tiers/chown` actions.
|
|
|
|
### Project-specific users
|
|
|
|
Every project located at `{repository root}/{node}/{project}` is assigned a dedicated system user on the host.
|
|
|
|
- **Isolation**: If a container is compromised, the attacker only gains the privileges of that specific low-privileged user.
|
|
- **Filesystem safety**: Projects can only read/write to their own directories within the [Tiers](/root/glossary#tier).
|
|
|
|
## Docker socket protection {#socket-protection}
|
|
|
|
Direct access to `/var/run/docker.sock` is equivalent to root access on the host. As a best practice, it is highly recommended to protect the Docker socket. One way to achieve this is by utilizing a **Socket Proxy** (e.g., based on `tecnativa/docker-socket-proxy`) to filter and restrict access to the Docker API.
|
|
|
|
```yaml filename="docker-socket-proxy-example.yml"
|
|
services:
|
|
socket-proxy:
|
|
image: tecnativa/docker-socket-proxy:0
|
|
container_name: root-socket-proxy
|
|
user: "0:0"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
environment:
|
|
CONTAINERS: 1
|
|
SERVICES: 1
|
|
TASKS: 1
|
|
networks:
|
|
socket: {}
|
|
restart: unless-stopped
|
|
|
|
traefik:
|
|
# ...
|
|
depends_on:
|
|
- socket-proxy
|
|
command:
|
|
# Use the proxy instead of the local socket
|
|
- "--providers.docker.endpoint=tcp://root-socket-proxy:2375"
|
|
networks:
|
|
socket: {}
|
|
```
|
|
|
|
## Security Monitoring (CrowdSec) {#crowdsec}
|
|
|
|
The framework integrates **CrowdSec** for behavioral detection and automated response.
|
|
|
|
- **Intrusion detection**: CrowdSec monitors logs from [Traefik](https://traefik.io/) and SSH for suspicious patterns (e.g., brute-force attacks, port scanning).
|
|
- **Automated blocking**: When a threat is detected, the **CrowdSec Firewall Bouncer** automatically updates [UFW](https://help.ubuntu.com/community/UFW) rules to block the malicious IP at the host level.
|
|
- **Shared threat intelligence**: CrowdSec shares anonymized threat data with its community, providing preemptive protection against known bad actors.
|
|
|
|
## Network hardening {#networking}
|
|
|
|
Root uses `configure/ufw` to implement a "Default Deny" policy.
|
|
|
|
- **Internal routing**: Services communicate over a dedicated `root-proxy` bridge network, which is often configured as `internal: true`.
|
|
- **Enclave isolation**: Outgoing traffic can be routed through a dedicated egress node for granular control.
|
|
|
|
---
|
|
|
|
**See also:**
|
|
|
|
- [Concept: Tiered storage](/root/concepts/tiered-storage)
|
|
- [Guide: Action development](/root/guides/action-development)
|