MACRO NEPAL
Rootless Containers in Java: Secure Container Operations Without Root
awiskar acharya
December 15, 2025
1:52 pm

Article

Rootless containers allow container engines to run without root privileges, significantly improving security by reducing the attack surface. This guide covers how to interact with and manage rootless containers from Java applications, using various libraries and approaches.

Why Rootless Containers?

  • Enhanced Security: No root privileges = smaller attack surface
  • Compliance: Meets security requirements in multi-tenant environments
  • User Namespaces: Leverage Linux kernel namespaces for isolation
  • Podman Support: Native rootless mode in Podman
  • Docker Rootless Mode: Experimental but available

Project Setup and Dependencies

Maven Dependencies:

<properties>
<docker-java.version>3.3.4</docker-java.version>
<podman-java.version>1.0.0</podman-java.version>
<jna.version>5.13.0</jna.version>
</properties>
<dependencies>
<!-- Docker Java Client -->
<dependency>
<groupId>com.github.docker-java</groupId>
<artifactId>docker-java</artifactId>
<version>${docker-java.version}</version>
</dependency>
<!-- Podman Java Client (when available) -->
<!-- Alternative: Use Podman's Docker-compatible API -->
<!-- Unix Socket Communication -->
<dependency>
<groupId>com.github.jnr</groupId>
<artifactId>jnr-unixsocket</artifactId>
<version>0.38.19</version>
</dependency>
<!-- JNA for Native Operations -->
<dependency>
<groupId>net.java.dev.jna</groupId>
<artifactId>jna</artifactId>
<version>${jna.version}</version>
</dependency>
<dependency>
<groupId>net.java.dev.jna</groupId>
<artifactId>jna-platform</artifactId>
<version>${jna.version}</version>
</dependency>
<!-- Process Execution -->
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-exec</artifactId>
<version>1.3</version>
</dependency>
<!-- JSON Processing -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.15.2</version>
</dependency>
</dependencies>

1. Understanding Rootless Container Architecture

Rootless containers work through:

  1. User Namespaces: Map UID/GID inside container to non-root outside
  2. RootlessKit: Parent process for user namespace creation
  3. Slirp4netns: User-mode networking stack
  4. FUSE-overlayfs: User-mode filesystem for layers

2. Podman Rootless Client (Primary Approach)

Podman has excellent native support for rootless containers.

Podman Rootless Client:

package com.example.rootless.podman;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.apache.commons.exec.CommandLine;
import org.apache.commons.exec.DefaultExecutor;
import org.apache.commons.exec.ExecuteWatchdog;
import org.apache.commons.exec.PumpStreamHandler;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.*;
public class PodmanRootlessClient {
private final String podmanPath;
private final ObjectMapper objectMapper;
private final Map<String, String> environment;
public PodmanRootlessClient() {
this("/usr/bin/podman");
}
public PodmanRootlessClient(String podmanPath) {
this.podmanPath = podmanPath;
this.objectMapper = new ObjectMapper();
this.environment = new HashMap<>();
// Setup environment for rootless operation
setupRootlessEnvironment();
}
private void setupRootlessEnvironment() {
// Important environment variables for rootless Podman
environment.put("XDG_RUNTIME_DIR", 
System.getenv().getOrDefault("XDG_RUNTIME_DIR", "/run/user/" + getUserId()));
// Set storage directory for rootless user
String userHome = System.getProperty("user.home");
environment.put("XDG_DATA_HOME", userHome + "/.local/share");
// Ensure we're not using root
environment.put("PODMAN_USERNS", "keep-id");
}
public String runContainer(String image, List<String> command, Map<String, String> options) 
throws IOException {
CommandLine cmdLine = new CommandLine(podmanPath);
cmdLine.addArgument("run");
cmdLine.addArgument("--rm");
// Rootless-specific flags
cmdLine.addArgument("--userns=keep-id");
cmdLine.addArgument("--security-opt=no-new-privileges");
cmdLine.addArgument("--pids-limit=100");
// Add user options
if (options != null) {
options.forEach((key, value) -> {
cmdLine.addArgument("--" + key);
if (value != null && !value.isEmpty()) {
cmdLine.addArgument(value);
}
});
}
cmdLine.addArgument(image);
if (command != null) {
command.forEach(cmdLine::addArgument);
}
return executeCommand(cmdLine);
}
public String createRootlessPod(String name, Map<String, String> options) throws IOException {
CommandLine cmdLine = new CommandLine(podmanPath);
cmdLine.addArgument("pod");
cmdLine.addArgument("create");
cmdLine.addArgument("--name");
cmdLine.addArgument(name);
// Rootless pod options
cmdLine.addArgument("--infra=false"); // No infra container for simpler rootless
cmdLine.addArgument("--share=net,ipc");
if (options != null) {
if (options.containsKey("network")) {
cmdLine.addArgument("--network");
cmdLine.addArgument(options.get("network"));
}
}
return executeCommand(cmdLine);
}
public List<ContainerInfo> listContainers(boolean all) throws IOException {
CommandLine cmdLine = new CommandLine(podmanPath);
cmdLine.addArgument("ps");
if (all) {
cmdLine.addArgument("-a");
}
cmdLine.addArgument("--format");
cmdLine.addArgument("json");
String output = executeCommand(cmdLine);
return objectMapper.readValue(output, 
objectMapper.getTypeFactory().constructCollectionType(List.class, ContainerInfo.class));
}
public String executeInContainer(String containerId, String[] command) throws IOException {
CommandLine cmdLine = new CommandLine(podmanPath);
cmdLine.addArgument("exec");
cmdLine.addArgument("-u");
cmdLine.addArgument(String.valueOf(getUserId())); // Execute as current user
cmdLine.addArgument(containerId);
cmdLine.addArguments(command);
return executeCommand(cmdLine);
}
public void setupUserNamespace(Map<String, String> subuidMap, Map<String, String> subgidMap) 
throws IOException {
// Create /etc/subuid and /etc/subgid entries for user namespace
String username = System.getProperty("user.name");
int uid = getUserId();
// Write subuid mapping
StringBuilder subuid = new StringBuilder();
subuid.append(username).append(":");
subuid.append(uid).append(":65536\n"); // Map 65536 UIDs
Files.write(Paths.get("/etc/subuid"), subuid.toString().getBytes());
// Write subgid mapping
StringBuilder subgid = new StringBuilder();
subgid.append(username).append(":");
subgid.append(uid).append(":65536\n"); // Map 65536 GIDs
Files.write(Paths.get("/etc/subgid"), subgid.toString().getBytes());
}
private String executeCommand(CommandLine cmdLine) throws IOException {
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
ByteArrayOutputStream errorStream = new ByteArrayOutputStream();
DefaultExecutor executor = new DefaultExecutor();
executor.setWatchdog(new ExecuteWatchdog(60000)); // 60 second timeout
executor.setStreamHandler(new PumpStreamHandler(outputStream, errorStream));
// Set environment
Map<String, String> env = new HashMap<>(System.getenv());
env.putAll(environment);
try {
int exitValue = executor.execute(cmdLine, env);
if (exitValue != 0) {
throw new IOException("Command failed: " + errorStream.toString());
}
return outputStream.toString();
} catch (Exception e) {
throw new IOException("Failed to execute command: " + e.getMessage() + 
"\nError: " + errorStream.toString(), e);
}
}
private int getUserId() {
try {
Process process = Runtime.getRuntime().exec("id -u");
try (var reader = new java.io.BufferedReader(
new java.io.InputStreamReader(process.getInputStream()))) {
String uid = reader.readLine();
return Integer.parseInt(uid.trim());
}
} catch (Exception e) {
return 1000; // Default fallback
}
}
// Container information class
public static class ContainerInfo {
private String id;
private String image;
private String command;
private String created;
private String status;
private List<String> names;
// Getters and setters
public String getId() { return id; }
public void setId(String id) { this.id = id; }
public String getImage() { return image; }
public void setImage(String image) { this.image = image; }
public String getCommand() { return command; }
public void setCommand(String command) { this.command = command; }
public String getCreated() { return created; }
public void setCreated(String created) { this.created = created; }
public String getStatus() { return status; }
public void setStatus(String status) { this.status = status; }
public List<String> getNames() { return names; }
public void setNames(List<String> names) { this.names = names; }
}
}

3. Docker Rootless Mode Client

Docker also supports rootless mode through dockerd-rootless.sh.

Docker Rootless Client:

package com.example.rootless.docker;
import com.github.dockerjava.api.DockerClient;
import com.github.dockerjava.api.command.CreateContainerResponse;
import com.github.dockerjava.api.model.*;
import com.github.dockerjava.core.DefaultDockerClientConfig;
import com.github.dockerjava.core.DockerClientImpl;
import com.github.dockerjava.httpclient5.ApacheDockerHttpClient;
import java.io.File;
import java.time.Duration;
import java.util.*;
public class DockerRootlessClient {
private final DockerClient dockerClient;
private final String socketPath;
public DockerRootlessClient() {
// Rootless Docker socket location
this.socketPath = System.getenv().getOrDefault(
"DOCKER_HOST", 
"unix:///run/user/" + getUserId() + "/docker.sock"
);
DefaultDockerClientConfig config = DefaultDockerClientConfig.createDefaultConfigBuilder()
.withDockerHost(socketPath)
.withDockerTlsVerify(false)
.build();
ApacheDockerHttpClient httpClient = new ApacheDockerHttpClient.Builder()
.dockerHost(config.getDockerHost())
.sslConfig(config.getSSLConfig())
.maxConnections(100)
.connectionTimeout(Duration.ofSeconds(30))
.responseTimeout(Duration.ofSeconds(45))
.build();
this.dockerClient = DockerClientImpl.getInstance(config, httpClient);
}
public String createRootlessContainer(String image, String command, Map<String, String> options) {
// Create container with rootless constraints
HostConfig hostConfig = HostConfig.newHostConfig()
.withMemory(256 * 1024 * 1024L) // 256MB limit
.withCpuShares(512) // CPU limit
.withPidsLimit(100L) // Process limit
.withSecurityOpts(Arrays.asList(
"no-new-privileges",
"seccomp=unconfined" // Rootless may need custom seccomp
))
.withUsernsMode("host") // Use host user namespace
.withRuntime("runc"); // Use runc runtime
// Add bind mounts with proper UID/GID mapping
if (options != null && options.containsKey("volume")) {
hostConfig.withBinds(Bind.parse(options.get("volume")));
}
CreateContainerResponse container = dockerClient.createContainerCmd(image)
.withCmd(command.split(" "))
.withHostConfig(hostConfig)
.withUser(String.valueOf(getUserId())) // Run as current user
.exec();
// Start container
dockerClient.startContainerCmd(container.getId()).exec();
return container.getId();
}
public void runRootlessContainer(String image, String command) {
String containerId = createRootlessContainer(image, command, null);
// Attach to container to get output
dockerClient.attachContainerCmd(containerId)
.withStdOut(true)
.withStdErr(true)
.withFollowStream(true)
.exec(new com.github.dockerjava.api.async.ResultCallback.Adapter<>() {
@Override
public void onNext(Frame item) {
System.out.println(new String(item.getPayload()));
}
});
}
public List<Container> listRootlessContainers() {
return dockerClient.listContainersCmd()
.withShowAll(true)
.exec();
}
public void setupRootlessDocker() throws Exception {
// This would start dockerd-rootless.sh if not running
String userHome = System.getProperty("user.home");
File rootlessKit = new File(userHome + "/bin/rootlesskit");
if (!rootlessKit.exists()) {
installRootlessKit();
}
// Check if Docker rootless is running
Process process = Runtime.getRuntime().exec("systemctl --user is-active docker-rootless");
int exitCode = process.waitFor();
if (exitCode != 0) {
// Start Docker rootless
startRootlessDocker();
}
}
private void installRootlessKit() throws Exception {
// Install RootlessKit and dependencies
ProcessBuilder pb = new ProcessBuilder(
"curl", "-fsSL", "https://get.docker.com/rootless", "-o", "install-rootless.sh"
);
Process process = pb.start();
process.waitFor();
pb = new ProcessBuilder("sh", "install-rootless.sh");
process = pb.start();
process.waitFor();
}
private void startRootlessDocker() throws Exception {
// Start Docker in rootless mode
String userHome = System.getProperty("user.home");
ProcessBuilder pb = new ProcessBuilder(
userHome + "/bin/dockerd-rootless.sh"
);
Process process = pb.start();
// Wait for Docker socket to be ready
Thread.sleep(5000);
}
private int getUserId() {
try {
Process process = Runtime.getRuntime().exec("id -u");
try (var reader = new java.io.BufferedReader(
new java.io.InputStreamReader(process.getInputStream()))) {
String uid = reader.readLine();
return Integer.parseInt(uid.trim());
}
} catch (Exception e) {
return 1000;
}
}
}

4. User Namespace Management in Java

Direct interaction with Linux user namespaces.

User Namespace Manager:

package com.example.rootless.namespaces;
import com.sun.jna.*;
import com.sun.jna.ptr.IntByReference;
import java.io.File;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
public class UserNamespaceManager {
// JNA interface for Linux syscalls
public interface CLibrary extends Library {
CLibrary INSTANCE = Native.load("c", CLibrary.class);
int unshare(int flags);
int setns(int fd, int nstype);
int clone(int flags, Pointer child_stack, Pointer ptid, Pointer ctid, Pointer regs);
int getuid();
int getgid();
int setuid(int uid);
int setgid(int gid);
}
// Linux namespace constants
public static final int CLONE_NEWUSER = 0x10000000;
public static final int CLONE_NEWNS = 0x00020000;
public static final int CLONE_NEWPID = 0x20000000;
public static final int CLONE_NEWNET = 0x40000000;
public static final int CLONE_NEWIPC = 0x08000000;
public static final int CLONE_NEWUTS = 0x04000000;
public static final int CLONE_NEWCGROUP = 0x02000000;
public void createUserNamespace(int uid, int gid) throws IOException {
// Create new user namespace
int result = CLibrary.INSTANCE.unshare(CLONE_NEWUSER);
if (result != 0) {
throw new IOException("Failed to create user namespace: " + 
Native.getLastError());
}
// Setup UID/GID mappings
setupUidMapping(uid);
setupGidMapping(gid);
}
private void setupUidMapping(int uid) throws IOException {
// Write to /proc/self/uid_map
String mapping = "0 " + uid + " 1";
Files.write(Paths.get("/proc/self/uid_map"), mapping.getBytes());
// Write to /proc/self/setgroups
Files.write(Paths.get("/proc/self/setgroups"), "deny".getBytes());
}
private void setupGidMapping(int gid) throws IOException {
// Write to /proc/self/gid_map
String mapping = "0 " + gid + " 1";
Files.write(Paths.get("/proc/self/gid_map"), mapping.getBytes());
}
public void createRootlessContainerNamespace() throws IOException {
// Create all namespaces for container isolation
int flags = CLONE_NEWUSER | CLONE_NEWNS | CLONE_NEWPID | 
CLONE_NEWNET | CLONE_NEWIPC | CLONE_NEWUTS;
int result = CLibrary.INSTANCE.unshare(flags);
if (result != 0) {
throw new IOException("Failed to create container namespaces: " + 
Native.getLastError());
}
// Now we're in an isolated namespace
// Mount proc filesystem
mountProc();
}
private void mountProc() throws IOException {
ProcessBuilder pb = new ProcessBuilder("mount", "-t", "proc", "proc", "/proc");
Process process = pb.start();
try {
int exitCode = process.waitFor();
if (exitCode != 0) {
throw new IOException("Failed to mount /proc");
}
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
throw new IOException("Interrupted while mounting /proc", e);
}
}
public static class ContainerNamespace {
private final Path namespaceDir;
private final int pid;
public ContainerNamespace(String name) throws IOException {
this.namespaceDir = Paths.get("/var/run/user/" + 
CLibrary.INSTANCE.getuid() + "/" + name);
Files.createDirectories(namespaceDir);
// Create namespace files
createNamespaceFiles();
this.pid = createContainerProcess();
}
private void createNamespaceFiles() throws IOException {
// Create user namespace
Files.write(namespaceDir.resolve("userns"), 
String.valueOf(CLONE_NEWUSER).getBytes());
// Create PID namespace
Files.write(namespaceDir.resolve("pidns"), 
String.valueOf(CLONE_NEWPID).getBytes());
// Create network namespace
Files.write(namespaceDir.resolve("netns"), 
String.valueOf(CLONE_NEWNET).getBytes());
}
private int createContainerProcess() throws IOException {
// Use fork to create process in new namespace
ProcessBuilder pb = new ProcessBuilder("unshare", 
"--user", "--pid", "--fork", "--mount-proc",
"sleep", "infinity");
Process process = pb.start();
return (int) process.pid();
}
public void executeInNamespace(String[] command) throws IOException {
// Use nsenter to enter namespace and execute command
ProcessBuilder pb = new ProcessBuilder("nsenter", 
"--user=/proc/" + pid + "/ns/user",
"--pid=/proc/" + pid + "/ns/pid",
"--net=/proc/" + pid + "/ns/net",
"sh", "-c", String.join(" ", command));
Process process = pb.start();
// Read output
try (var reader = new java.io.BufferedReader(
new java.io.InputStreamReader(process.getInputStream()))) {
reader.lines().forEach(System.out::println);
}
}
public void destroy() throws IOException {
// Kill the container process
ProcessBuilder pb = new ProcessBuilder("kill", "-9", String.valueOf(pid));
pb.start();
// Clean up namespace directory
Files.walk(namespaceDir)
.sorted(java.util.Comparator.reverseOrder())
.map(Path::toFile)
.forEach(File::delete);
}
}
}

5. Rootless Container Security Manager

Security Policy Enforcement:

package com.example.rootless.security;
import java.io.File;
import java.io.IOException;
import java.nio.file.*;
import java.nio.file.attribute.PosixFilePermission;
import java.util.*;
public class RootlessSecurityManager {
public void applyRootlessSecurityProfile(String containerId) throws IOException {
// Apply AppArmor profile for rootless containers
applyAppArmorProfile(containerId);
// Setup seccomp filter
setupSeccompProfile(containerId);
// Set capabilities
setupCapabilities(containerId);
// Configure cgroups
setupCgroups(containerId);
}
private void applyAppArmorProfile(String containerId) throws IOException {
String profile = """
#include <tunables/global>
profile rootless-container flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
# Deny privileged operations
deny capability sys_admin,
deny capability sys_module,
deny capability sys_rawio,
# Allow necessary operations
capability chown,
capability dac_override,
capability fowner,
capability fsetid,
capability kill,
capability setgid,
capability setuid,
capability setpcap,
capability net_bind_service,
capability net_raw,
capability sys_chroot,
capability mknod,
capability audit_write,
capability setfcap,
# Network access
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
# File system access
deny @{PROC}/sys/** rwklx,
deny @{SYS}/** rwklx,
# Allow writing to temporary directories
/tmp/** rw,
/var/tmp/** rw,
# Home directory access (user-specific)
/home/{user}/** rw,
}
""";
// Write profile to AppArmor directory
Path profilePath = Paths.get("/etc/apparmor.d/rootless-" + containerId);
Files.write(profilePath, profile.getBytes());
// Load profile
ProcessBuilder pb = new ProcessBuilder("apparmor_parser", 
"-r", profilePath.toString());
Process process = pb.start();
try {
process.waitFor();
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
}
}
private void setupSeccompProfile(String containerId) throws IOException {
String seccompProfile = """
{
"defaultAction": "SCMP_ACT_ERRNO",
"architectures": [
"SCMP_ARCH_X86_64",
"SCMP_ARCH_X86",
"SCMP_ARCH_X32"
],
"syscalls": [
{
"names": [
"accept",
"accept4",
"access",
"alarm",
"bind",
"brk",
"capget",
"capset",
"chdir",
"chmod",
"chown",
"chown32",
"clock_getres",
"clock_gettime",
"clock_nanosleep",
"close",
"connect",
"copy_file_range",
"creat",
"dup",
"dup2",
"dup3",
"epoll_create",
"epoll_create1",
"epoll_ctl",
"epoll_pwait",
"epoll_wait",
"eventfd",
"eventfd2",
"execve",
"execveat",
"exit",
"exit_group",
"faccessat",
"faccessat2",
"fadvise64",
"fallocate",
"fchdir",
"fchmod",
"fchmodat",
"fchown",
"fchown32",
"fchownat",
"fcntl",
"fcntl64",
"fdatasync",
"fgetxattr",
"flistxattr",
"flock",
"fork",
"fremovexattr",
"fsetxattr",
"fstat",
"fstat64",
"fstatat64",
"fsync",
"ftruncate",
"ftruncate64",
"futex",
"futimesat",
"getcpu",
"getcwd",
"getdents",
"getdents64",
"getegid",
"getegid32",
"geteuid",
"geteuid32",
"getgid",
"getgid32",
"getgroups",
"getgroups32",
"getitimer",
"getpeername",
"getpgid",
"getpgrp",
"getpid",
"getppid",
"getpriority",
"getrandom",
"getresgid",
"getresgid32",
"getresuid",
"getresuid32",
"getrlimit",
"getrusage",
"getsid",
"getsockname",
"getsockopt",
"get_thread_area",
"gettid",
"gettimeofday",
"getuid",
"getuid32",
"getxattr",
"inotify_add_watch",
"inotify_init",
"inotify_init1",
"inotify_rm_watch",
"io_cancel",
"ioctl",
"io_destroy",
"io_getevents",
"ioprio_get",
"ioprio_set",
"io_setup",
"io_submit",
"ipc",
"kill",
"lchown",
"lchown32",
"lgetxattr",
"link",
"linkat",
"listen",
"listxattr",
"llistxattr",
"_llseek",
"lremovexattr",
"lseek",
"lsetxattr",
"lstat",
"lstat64",
"madvise",
"memfd_create",
"mincore",
"mkdir",
"mkdirat",
"mknod",
"mknodat",
"mlock",
"mlock2",
"mlockall",
"mmap",
"mmap2",
"mprotect",
"mq_getsetattr",
"mq_notify",
"mq_open",
"mq_timedreceive",
"mq_timedsend",
"mq_unlink",
"mremap",
"msgctl",
"msgget",
"msgrcv",
"msgsnd",
"msync",
"munlock",
"munlockall",
"munmap",
"nanosleep",
"newfstatat",
"_newselect",
"open",
"openat",
"pause",
"pipe",
"pipe2",
"poll",
"ppoll",
"prctl",
"pread64",
"preadv",
"preadv2",
"prlimit64",
"pwrite64",
"pwritev",
"pwritev2",
"read",
"readahead",
"readlink",
"readlinkat",
"readv",
"recv",
"recvfrom",
"recvmmsg",
"recvmsg",
"remap_file_pages",
"removexattr",
"rename",
"renameat",
"renameat2",
"restart_syscall",
"rmdir",
"rt_sigaction",
"rt_sigpending",
"rt_sigprocmask",
"rt_sigqueueinfo",
"rt_sigreturn",
"rt_sigsuspend",
"rt_sigtimedwait",
"rt_tgsigqueueinfo",
"sched_getaffinity",
"sched_getattr",
"sched_getparam",
"sched_get_priority_max",
"sched_get_priority_min",
"sched_getscheduler",
"sched_rr_get_interval",
"sched_setaffinity",
"sched_setattr",
"sched_setparam",
"sched_setscheduler",
"sched_yield",
"seccomp",
"select",
"semctl",
"semget",
"semop",
"semtimedop",
"send",
"sendmmsg",
"sendmsg",
"sendto",
"setfsgid",
"setfsgid32",
"setfsuid",
"setfsuid32",
"setgid",
"setgid32",
"setgroups",
"setgroups32",
"setitimer",
"setpgid",
"setpriority",
"setregid",
"setregid32",
"setresgid",
"setresgid32",
"setresuid",
"setresuid32",
"setreuid",
"setreuid32",
"setrlimit",
"setsid",
"setsockopt",
"set_thread_area",
"set_tid_address",
"setuid",
"setuid32",
"setxattr",
"shmat",
"shmctl",
"shmdt",
"shmget",
"shutdown",
"sigaltstack",
"signalfd",
"signalfd4",
"sigprocmask",
"sigreturn",
"socket",
"socketcall",
"socketpair",
"splice",
"stat",
"stat64",
"statfs",
"statfs64",
"symlink",
"symlinkat",
"sync",
"sync_file_range",
"sysinfo",
"tee",
"tgkill",
"time",
"timer_create",
"timer_delete",
"timer_getoverrun",
"timer_gettime",
"timer_settime",
"timerfd_create",
"timerfd_gettime",
"timerfd_settime",
"times",
"tkill",
"truncate",
"truncate64",
"ugetrlimit",
"umask",
"uname",
"unlink",
"unlinkat",
"utime",
"utimensat",
"utimes",
"vfork",
"vmsplice",
"wait4",
"waitid",
"waitpid",
"write",
"writev"
],
"action": "SCMP_ACT_ALLOW"
}
]
}
""";
// Write seccomp profile
Path seccompPath = Paths.get("/var/lib/rootless/seccomp-" + containerId + ".json");
Files.createDirectories(seccompPath.getParent());
Files.write(seccompPath, seccompProfile.getBytes());
}
private void setupCapabilities(String containerId) throws IOException {
// Define allowed capabilities for rootless containers
Set<String> allowedCapabilities = Set.of(
"CAP_CHOWN",
"CAP_DAC_OVERRIDE",
"CAP_FOWNER",
"CAP_FSETID",
"CAP_KILL",
"CAP_SETGID",
"CAP_SETUID",
"CAP_SETPCAP",
"CAP_NET_BIND_SERVICE",
"CAP_NET_RAW",
"CAP_SYS_CHROOT",
"CAP_MKNOD",
"CAP_AUDIT_WRITE",
"CAP_SETFCAP"
);
// Write capabilities to container config
String capabilities = String.join(",", allowedCapabilities);
Path capsPath = Paths.get("/var/lib/rootless/caps-" + containerId);
Files.write(capsPath, capabilities.getBytes());
}
private void setupCgroups(String containerId) throws IOException {
// Create cgroup for the container
String cgroupPath = "/sys/fs/cgroup/user.slice/rootless-" + containerId;
Files.createDirectories(Paths.get(cgroupPath));
// Set memory limit (e.g., 512MB)
Files.write(Paths.get(cgroupPath + "/memory.max"), "536870912".getBytes());
// Set CPU limit (e.g., 50% of one CPU)
Files.write(Paths.get(cgroupPath + "/cpu.max"), "50000 100000".getBytes());
// Set PID limit
Files.write(Paths.get(cgroupPath + "/pids.max"), "100".getBytes());
}
public void secureContainerFilesystem(String containerId, String rootfs) throws IOException {
// Apply filesystem security measures
// 1. Make rootfs read-only where possible
ProcessBuilder pb = new ProcessBuilder("mount", "-o", "bind,ro", 
rootfs, rootfs);
pb.start();
// 2. Setup tmpfs for /tmp and /run
Path tmpPath = Paths.get(rootfs, "tmp");
Files.createDirectories(tmpPath);
pb = new ProcessBuilder("mount", "-t", "tmpfs", "tmpfs", tmpPath.toString());
pb.start();
// 3. Set proper permissions
Files.setPosixFilePermissions(tmpPath, Set.of(
PosixFilePermission.OWNER_READ,
PosixFilePermission.OWNER_WRITE,
PosixFilePermission.OWNER_EXECUTE
));
// 4. Prevent SUID binaries
Process findSuid = Runtime.getRuntime().exec(
new String[]{"find", rootfs, "-type", "f", "-perm", "/4000"});
try (var reader = new java.io.BufferedReader(
new java.io.InputStreamReader(findSuid.getInputStream()))) {
reader.lines().forEach(suidFile -> {
try {
Files.setPosixFilePermissions(Paths.get(suidFile), 
Files.getPosixFilePermissions(Paths.get(suidFile))
.stream()
.filter(p -> p != PosixFilePermission.GROUP_EXECUTE)
.filter(p -> p != PosixFilePermission.OTHERS_EXECUTE)
.collect(java.util.stream.Collectors.toSet()));
} catch (IOException e) {
e.printStackTrace();
}
});
}
}
}

6. Spring Boot Integration for Rootless Containers

Spring Boot Configuration:

package com.example.rootless.config;
import com.example.rootless.podman.PodmanRootlessClient;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@Configuration
public class RootlessContainerConfig {
@Value("${rootless.podman.path:/usr/bin/podman}")
private String podmanPath;
@Value("${rootless.container.user:${user.name}}")
private String containerUser;
@Bean
public PodmanRootlessClient podmanRootlessClient() {
return new PodmanRootlessClient(podmanPath);
}
@Bean
public RootlessContainerService containerService(PodmanRootlessClient client) {
return new RootlessContainerService(client);
}
}
@Service
public class RootlessContainerService {
private final PodmanRootlessClient podmanClient;
private final Map<String, String> activeContainers = new ConcurrentHashMap<>();
public RootlessContainerService(PodmanRootlessClient podmanClient) {
this.podmanClient = podmanClient;
}
@Async
public CompletableFuture<String> startApplicationContainer(
String image, 
String applicationJar,
Map<String, String> env) throws IOException {
// Create volume mapping for application JAR
Map<String, String> options = new HashMap<>();
options.put("volume", applicationJar + ":/app/application.jar");
// Add environment variables
StringBuilder envString = new StringBuilder();
env.forEach((key, value) -> envString.append("-e ").append(key).append("=").append(value).append(" "));
// Run container with Java
List<String> command = Arrays.asList(
"java", "-jar", "/app/application.jar"
);
String containerId = podmanClient.runContainer(image, command, options);
activeContainers.put(containerId, image);
return CompletableFuture.completedFuture(containerId);
}
public List<ContainerInfo> getRunningContainers() throws IOException {
return podmanClient.listContainers(false);
}
@PreDestroy
public void cleanup() {
// Stop all containers on application shutdown
activeContainers.keySet().forEach(containerId -> {
try {
stopContainer(containerId);
} catch (IOException e) {
System.err.println("Failed to stop container: " + containerId);
}
});
}
public void stopContainer(String containerId) throws IOException {
// Implementation using podman stop command
activeContainers.remove(containerId);
}
}

7. Monitoring and Metrics for Rootless Containers

package com.example.rootless.monitoring;
import io.micrometer.core.instrument.MeterRegistry;
import io.micrometer.core.instrument.Timer;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.stereotype.Service;
import java.io.IOException;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.TimeUnit;
@Service
public class RootlessContainerMetrics {
private final MeterRegistry meterRegistry;
private final PodmanRootlessClient podmanClient;
private final Map<String, ContainerStats> containerStats = new ConcurrentHashMap<>();
public RootlessContainerMetrics(MeterRegistry meterRegistry, 
PodmanRootlessClient podmanClient) {
this.meterRegistry = meterRegistry;
this.podmanClient = podmanClient;
}
@Scheduled(fixedRate = 30000) // Every 30 seconds
public void collectContainerMetrics() throws IOException {
List<ContainerInfo> containers = podmanClient.listContainers(false);
containers.forEach(container -> {
// Collect CPU and memory usage
ContainerStats stats = getContainerStats(container.getId());
containerStats.put(container.getId(), stats);
// Record metrics
meterRegistry.gauge("rootless.container.memory.usage", 
stats.getMemoryUsage());
meterRegistry.gauge("rootless.container.cpu.usage", 
stats.getCpuUsage());
meterRegistry.counter("rootless.container.network.bytes",
"container", container.getId())
.increment(stats.getNetworkBytes());
});
}
private ContainerStats getContainerStats(String containerId) {
// Use podman stats command to get container statistics
try {
Process process = Runtime.getRuntime().exec(
new String[]{"podman", "stats", "--no-stream", "--format", "json", containerId});
try (var reader = new java.io.BufferedReader(
new java.io.InputStreamReader(process.getInputStream()))) {
String json = reader.lines().collect(java.util.stream.Collectors.joining());
return parseStatsJson(json);
}
} catch (IOException e) {
return new ContainerStats(0, 0, 0);
}
}
private ContainerStats parseStatsJson(String json) {
// Parse podman stats JSON output
// Simplified implementation
return new ContainerStats(
Math.random() * 100, // CPU %
Math.random() * 1024 * 1024 * 100, // Memory bytes
Math.random() * 1024 * 1024 // Network bytes
);
}
public static class ContainerStats {
private final double cpuUsage;
private final long memoryUsage;
private final long networkBytes;
public ContainerStats(double cpuUsage, long memoryUsage, long networkBytes) {
this.cpuUsage = cpuUsage;
this.memoryUsage = memoryUsage;
this.networkBytes = networkBytes;
}
// Getters
public double getCpuUsage() { return cpuUsage; }
public long getMemoryUsage() { return memoryUsage; }
public long getNetworkBytes() { return networkBytes; }
}
}

8. Best Practices for Production

Security Checklist:

public class RootlessSecurityChecklist {
public SecurityReport verifyRootlessSetup() {
SecurityReport report = new SecurityReport();
// 1. Verify user namespace support
if (!hasUserNamespaceSupport()) {
report.addIssue("User namespace not supported or enabled");
}
// 2. Verify subuid/subgid mappings
if (!hasSubuidMapping()) {
report.addIssue("No subuid mapping for current user");
}
// 3. Verify no root privileges
if (hasRootPrivileges()) {
report.addIssue("Process has root privileges");
}
// 4. Verify seccomp support
if (!hasSeccompSupport()) {
report.addWarning("Seccomp not available");
}
// 5. Verify AppArmor/SELinux
if (!hasMandatoryAccessControl()) {
report.addWarning("No mandatory access control enabled");
}
return report;
}
private boolean hasUserNamespaceSupport() {
try {
Process process = Runtime.getRuntime().exec(
"grep user_namespace /proc/self/uid_map");
return process.waitFor() == 0;
} catch (Exception e) {
return false;
}
}
private boolean hasSubuidMapping() {
String username = System.getProperty("user.name");
try {
Process process = Runtime.getRuntime().exec(
"grep " + username + " /etc/subuid");
return process.waitFor() == 0;
} catch (Exception e) {
return false;
}
}
private boolean hasRootPrivileges() {
return System.getProperty("user.name").equals("root") || 
new File("/.dockerenv").exists();
}
public static class SecurityReport {
private final List<String> issues = new ArrayList<>();
private final List<String> warnings = new ArrayList<>();
public void addIssue(String issue) {
issues.add(issue);
}
public void addWarning(String warning) {
warnings.add(warning);
}
public boolean isSecure() {
return issues.isEmpty();
}
}
}

Conclusion

Rootless containers in Java provide a secure way to run containers without root privileges. Key takeaways:

  1. Use Podman: Best native support for rootless containers
  2. Leverage User Namespaces: Core technology enabling rootless operation
  3. Apply Security Profiles: AppArmor, seccomp, and capabilities
  4. Monitor Resource Usage: Cgroups for resource limits
  5. Implement Proper Cleanup: Stop containers on application shutdown

This approach significantly reduces the attack surface while maintaining container functionality, making it ideal for multi-tenant environments and security-conscious deployments.

Advanced Java Container Security, Sandboxing & Trusted Runtime Environments

https://macronepal.com/blog/sandboxing-java-applications-implementing-landlock-lsm-for-enhanced-container-security/
Explains using Linux Landlock LSM to sandbox Java applications by restricting file system and resource access without root privileges, improving application-level isolation and reducing attack surface.

https://macronepal.com/blog/gvisor-sandbox-integration-in-java-complete-guide/
Explains integrating gVisor with Java to provide a user-space kernel sandbox that intercepts system calls and isolates applications from the host operating system for stronger security.

https://macronepal.com/blog/selinux-for-java-mandatory-access-control-for-jvm-applications/
Explains how SELinux enforces Mandatory Access Control (MAC) policies on Java applications, strictly limiting what files, processes, and network resources the JVM can access.

https://macronepal.com/java/a-comprehensive-guide-to-intel-sgx-sdk-integration-in-java/
Explains Intel SGX integration in Java, allowing sensitive code and data to run inside secure hardware enclaves that remain protected even if the OS is compromised.

https://macronepal.com/blog/building-a-microvm-runtime-with-aws-firecracker-in-java-a-comprehensive-guide/
Explains using AWS Firecracker microVMs with Java to run workloads in lightweight virtual machines that provide strong isolation with near-container performance efficiency.

https://macronepal.com/blog/enforcing-mandatory-access-control-implementing-apparmor-for-java-applications/
Explains AppArmor security profiles for Java applications, enforcing rules that restrict file access, execution rights, and system-level permissions.

https://macronepal.com/blog/rootless-containers-in-java-secure-container-operations-without-root/
Explains running Java applications in rootless containers using Linux user namespaces so containers operate securely without requiring root privileges.

https://macronepal.com/blog/unlocking-container-security-harnessing-user-namespaces-in-java/
Explains Linux user namespaces, which isolate user and group IDs inside containers to improve privilege separation and enhance container security for Java workloads.

https://macronepal.com/blog/secure-bootstrapping-in-java-comprehensive-trust-establishment-framework/
Explains secure bootstrapping in Java, focusing on how systems establish trust during startup using secure key management, identity verification, and trusted configuration loading.

https://macronepal.com/blog/securing-java-applications-with-chainguard-wolfi-a-comprehensive-guide-2/
Explains using Chainguard/Wolfi minimal container images to secure Java applications by reducing unnecessary packages, minimizing vulnerabilities, and providing a hardened runtime environment.

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper