Assigning Self-Specified UID in Kubernetes Containers

It is recommended that a self-specified UID is set in the container file. This should not overlap with a UID in the host VM. For example, if an attacker takes over the container with the help of a user with UID 1000 and breaks out, they will then have the same rights as a user on the host VM with UID 1000.

In a worst-case scenario, an attacker breaks out of a container that is running with the default root UID. This gives them access to the root directory and the associated root rights on the host VM.

To avert this risk, specially selected UIDs should be assigned, which are less likely to occur in normal use. However, care must be taken to ensure that the UID is not at the end of the used range. We recommend selecting the UID in the upper third. The same initial situations and risks apply to subsequent contexts.

Enhanced Security with Self-Specified UIDs

Self-specified UIDs improve security by adding an extra layer of isolation between the container and the host. When a container runs with a unique UID that does not overlap with any host UID, it minimizes the risk of privilege escalation. Here’s how:

Isolation of User Contexts: By assigning a unique UID to each container, it ensures that even if an attacker gains access to the container, they are confined to the permissions associated with that specific UID. This separation prevents the attacker from inheriting host-level privileges.

Mitigation of Privilege Escalation: Overlapping UIDs between the host and the container can lead to privilege escalation. For instance, if a container user has the same UID as a host user with elevated privileges, breaking out of the container could grant the attacker the same elevated rights on the host. By ensuring that container UIDs do not overlap with host UIDs, this risk is mitigated.

Reduced Attack Surface: Assigning UIDs from the upper third of the range ensures they are less likely to be used by default system processes or common user accounts. This reduces the likelihood of an attacker encountering a familiar or predictable environment that they could exploit.

In summary, carefully selected self-specified UIDs enhance security by maintaining strict isolation between container and host environments, thereby reducing the potential for malicious actors to exploit UID overlaps for unauthorized access or privilege escalation.