diff --git a/FAQ.md b/FAQ.md index 9d9942a..40168b1 100644 --- a/FAQ.md +++ b/FAQ.md @@ -1 +1,10 @@ -This is the FAQ page. \ No newline at end of file +### Why run non-root containers? + +In Linux, each process runs with a UID. Container processes (Docker, Podman, LXC, etc.) run as root, though they may run their containerized service as a non-root user, will still be running as root on their paravirtual host. + +This means that, should they be able to leverage privilege escalation exploits or otherwise escape the container, they will end up with control of a process with UID 0 (root). + +Non-root containers avoid this privilege escalation path for compromised container runtimes by running as non-root UIDs. + +#### Sources +[1] https://eitca.org/cybersecurity/eitc-is-lsa-linux-system-administration/linux-processes/processes-overview/examination-review-processes-overview/what-is-the-difference-between-user-id-uid-and-effective-user-id-euid-in-linux-processes/#:~:text=In%20the%20Linux%20operating%20system,while%20interacting%20with%20system%20resources. \ No newline at end of file