Posts

Introduction On a set of shared, multi-user Linux workstations, several things broke in the same few weeks. Files on a user’s NFS home showed up as nobody:nogroup. Once we tightened the share, a user could no longer write to their own home, even though ls showed them as the owner. A freshly provisioned home dataset came out owned by root:root with mode 755 instead of belonging to the user with mode 700. A user’s Jupyter container opened with the prompt I have no name! and sudo refused to work. ...

Bu yazının Türkçesi: OPA ile Docker Authorization 1. Introduction I set up opa-docker-authz to restrict Docker on shared, multi-user Linux workstations. After a routine policy update, I noticed that --privileged containers were silently running. This article summarizes that incident and what I found in the source code afterward. Docker authorization plugins let you evaluate every API request sent to the Docker daemon against a policy before the daemon processes it. opa-docker-authz is a plugin that implements this mechanism with OPA (Open Policy Agent) and its policy language, Rego. ...