rootless: update docs and examples

[AkihiroSuda]

Fix #5763

• Discourage --oci-worker-no-process-sandbox, due to the leakage of the processes (by design). Instead, encourage setting systempaths=unconfined in docker run. This corresponds to securityContext.procMount: Unmasked in Kubernetes, however, the configuration is hard on Kubernetes, as it has to be used in conjunction with hostUsers: false.

• Remove --device /dev/fuse, as fuse-overlayfs is no longer used typically.

• Use the new Kubernetes struct for AppArmor

• Add a hint about kernel.apparmor_restrict_unprivileged_userns

• Remove $ from command snippets for ease of copypasting

• Make job.*.yaml more practical

• Add *.userns.yaml. Needs UserNamespaceSupport feature gate to be enabled.

---

TODO: update buildx to support UserNS mode too

[tonistiigi]

I'm ok with the updates but isn't there a way to fix the specific process leak case if we have a reproducer? Even if we can't make it 100% guaranteed for other cases.

[AkihiroSuda]

I'm ok with the updates but isn't there a way to fix the specific process leak case if we have a reproducer? Even if we can't make it 100% guaranteed for other cases.

Potentially we may use seccomp (or ptrace) to catch fork, clone, execve, etc. to track the leaked processes?

[tonistiigi]

Potentially we may use seccomp (or ptrace) to catch fork, clone, execve, etc. to track the leaked processes?

That's an option, but maybe there is something simpler. What about cgroups? I don't know what the exact case is in here.

[AkihiroSuda]

Potentially we may use seccomp (or ptrace) to catch fork, clone, execve, etc. to track the leaked processes?

That's an option, but maybe there is something simpler. What about cgroups? I don't know what the exact case is in here.

Not sure

$ docker run -it --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined --user ubuntu ubuntu
ubuntu@552de0932c50:/$ unshare -rmC     
# mount -t cgroup2 none /sys/fs/cgroup
mount: /sys/fs/cgroup: none already mounted or mount point busy.
       dmesg(1) may have more information after failed mount system call.
# mount -t tmpfs none /sys/fs/cgroup
# mount -t cgroup2 none /sys/fs/cgroup
# mkdir /sys/fs/cgroup/foo
mkdir: cannot create directory '/sys/fs/cgroup/foo': Permission denied

[AkihiroSuda]

In containerd v2.1 we will get writable cgroups though:

• Enable Writable cgroups for unprivileged containers containerd/containerd#11131

[AkihiroSuda]

Can we merge?