TechPrufer
Get started
Netflix
Netflix logoNetflix · Feature trail

Container Security with User Namespaces

1 post · Aug 2021

What this trail covers

Netflix is evolving its container security by leveraging Linux user namespaces on Titus agents. This enhances security isolation in multi-tenant clusters by mapping container UIDs to host UIDs, preventing unmapped UIDs from accessing host resources and allowing containers to exercise privileges within their own namespace without granting them to the host's init user namespace. This mitigates risks associated with container escapes and lateral movement.

All Netflix trails
  1. Evolving Container Security With Linux User NamespacesThis post details how Netflix's Titus container orchestration system uses Linux user namespaces to improve security isolation. It explains the concept of user namespaces, how they map UIDs between the container and host, and how this mechanism prevents unmapped UIDs from accessing host resources. The post also discusses the importance of capabilities in Linux and how user namespaces allow containers to have specific capabilities without granting them to the host's root user, thereby mitigating container escape vulnerabilities and lateral movement.