# runc Published articles for runc. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How Chainguard protects against "Leaky Vessel" container escape vulnerabilities DevFeed: [How Chainguard protects against "Leaky Vessel" container escape vulnerabilities]() Original publisher: [Read original article]() Published: 2024-02-01T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [container-security](), [chainguard images](), [container images]() Tags: [apko](), [chainguard](), [container-escape](), [container-images](), [container-security](), [docker](), [docker-image](), [leaky-vessel](), [patches](), [runc](), [secure-by-default](), [upgrade]() ### AI overview This article explains the "Leaky Vessel" vulnerabilities affecting runc and BuildKit, including risks of container escape, host filesystem access, and elevated privileges. It describes how Chainguard Images use apko instead of runc or BuildKit and recommends upgrading to patched versions. ### Source excerpt Chainguard's response to 'Leaky Vessel' vulnerabilities: safeguarding container images with innovative, secure-by-default build processes. ## CVE-2019-5736 and the Security Meaning of Privileged Containers DevFeed: [CVE-2019-5736 and the Security Meaning of Privileged Containers]() Original publisher: [Read original article]() Author: Christian Brauner Published: 2019-02-11T23:00:00Z Content type: article Language: en Sources: [Personal blog of Christian Brauner]() Topics: [container](), [Containers](), [vulnerability](), [Exploit](), [Security](), [implementation]() Tags: [containers](), [cve](), [exploit](), [lxc](), [runc](), [security](), [vulnerability]() ### AI overview The article examines CVE-2019-5736, a vulnerability that could let a malicious container overwrite the host runc binary and gain root-level code execution. It then develops a more precise definition of privileged containers based on whether ID 0 has the same semantics inside and outside the container. ### Source excerpt Introduction (CVE-2019-5736) ## Runc Containers on the Desktop DevFeed: [Runc Containers on the Desktop]() Original publisher: [Read original article]() Published: 2016-01-19T02:17:14Z Content type: article Language: en Sources: [Jessie Frazelle]() Topics: [Containers](), [Docker](), [Code](), [Network]() Tags: [containers](), [docker](), [networking](), [oci](), [runc]() ### AI overview The article explains why the author converted Docker containers to runc configurations, focusing on user namespaces and device access. It also introduces Riddler, which converts Docker container inspection data into an OCI specification, and Netns, which provides bridge networking for runc containers. ### Source excerpt Almost exactly a year ago, I wrote a post about running Docker Containers on the Desktop. Well it is a new year, and I have ended up converting all my docker containers to runc configs, so it's the perfect time for a new blog post. For those of you unfamiliar with the Open Container Initiative you should check out opencontainers.org. Why the switch? you ask... well let me explain. Our fellow Docker maintainer and pal Phil Estes made an awesome patch to add user namespaces to Docker. Now me, being the completely insane containerizer that I am, desperately wanted to run all my crazy sound/video device mounting containers in user namespaces. Well the way this could work is by having a custom gid_map for the audio and video groups to map to the host groups so we can have permission to access these devices in the container. In layman's terms, I basically wanted to poke a teeny tiny map in the user namespace to be able to have permission to use my sound and video devices. Obviously this was not the design of the feature, but since runc exposes the uidMappings and gidMappings, I knew I could have the power to do as I please. This is the awesome thing about runc. You, the user, have all the control. So for chrome, this is what you get for mappings: github.com/jessfraz/containers:chrome/config.json#L223. If you look closely, or know what you are looking at, you can see group 29 and 44 are mapped to the same group ids as the host. Then you can do cool things like listen to Taylor Swift in a container with a user namespace. Pretty cool right. So I went all OCD on this, like most things I encounter, and I converted all my containers. Obviously I found a way to generate them. Riddler Introducing github.com/jessfraz/riddler! riddler will take a running/stopped docker container and convert the inspect information into the oci spec (which can be run by runc, or any other oci compatible tool). It has some opinionated features in that it will always try to set up a gid_map that works w