I've read numerous articles on this going back to 2013, but what I wasn't able to ascertain is whether a reliable method has yet been devised for auditing processes inside a container. This question applies primarily to Linux, as I'm not very familiar with containerization on other platforms.
The problem is essentially this: How to track operations such as Linux system calls back to the user who created the container?
With Docker, that information is lost because the container is started by a daemon, and Docker doesn't have an authentication mechanism in place for identifying the user.
Podman takes the approach of creating a container as a process fork, rather than using a client/daemon, which preserves the loginuid, but what about across a cluster.
Kubernetes has auditing functionality, but I haven't been able to determine from the documentation whether that applies to processes running in containers, or only to K8s API calls.
It's seems like it would be possible to do this by:
1 - Require a user to authenticate when starting a container.
2 - Send the user name when starting the container on each node.
3 - Preserve the user ID in a process attribute.
2, to work, the user would have to be known to each host, and not just the container daemon.
A trivial case of
3, would be for the user in the container to have the same UID, and the authorization stage could enforce that. But that's pretty limiting.
Has anyone managed to address this successfully, or is it still an open issue? Either a global solution, or for a particular containerization technology/orchestrator.
Here are some links regarding proposals for implementing this in the kernel: