7

I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a Kernel feature and Docker uses the host kernel to run, thus not making it easily possible to disable ASLR only for Docker.

How can I disable ASLR only inside the Docker container ?

2
  • Is your question answered with this post or the linked question?
    – mhr
    Aug 8, 2019 at 9:25
  • If one of these answers helped, you should mark it as accepted. :)
    – forest
    May 25, 2021 at 1:18

4 Answers 4

4

You can use the personality(2) syscall to set the ADDR_NO_RANDOMIZE flag for a process. That process, and any of its children, will not be using ASLR. Do this in whatever process starts Docker.

ADDR_NO_RANDOMIZE (since Linux 2.6.12)
       With this flag set, disable address-space-layout
       randomization.
3

I was trying to make this work for a CTF environment.

What didn't work:

  • using personality with ADDR_NO_RANDOMIZE will make any SUID app ignore the flag.
  • giving the docker extra privileges with --privileged

Solution

The only way to achieve this is to change ASLR configuration on host kernel using:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
1

So essentially you're right, disabling ASLR is a kernel setting, you'd need to make the change at a kernel level.

There's a couple of options here.

  1. Make the change to the host before starting the container.
  2. Mount /proc inside the container and make the change from inside the container
  3. Use something like KataContainers to run the container with it's own kernel, and then make the change in there.

In theory, all of those should work, but which is good for you will depend on your precise use-case.

0

For docker on macos, first you need to enter docker desktop Mac VM to modify the kernel config, which can be done with https://gist.github.com/BretFisher/5e1a0c7bcca4c735e716abf62afad389

# enter docker vm
docker run -it --rm --privileged --pid=host justincormack/nsenter1
# disable ASLR
echo 0  > /proc/sys/kernel/randomize_va_space 
# enable ASLR
echo 2  > /proc/sys/kernel/randomize_va_space 

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .