Disable ASLR inside Docker container

Question

I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a Kernel feature and Docker uses the host kernel to run, thus not making it easily possible to disable ASLR only for Docker.

How can I disable ASLR only inside the Docker container ?

Answer 1

You can use the personality(2) syscall to set the ADDR_NO_RANDOMIZE flag for a process. That process, and any of its children, will not be using ASLR. Do this in whatever process starts Docker.

ADDR_NO_RANDOMIZE (since Linux 2.6.12)
       With this flag set, disable address-space-layout
       randomization.

Answer 2

I was trying to make this work for a CTF environment.

What didn't work:

• using personality with ADDR_NO_RANDOMIZE will make any SUID app ignore the flag.
• giving the docker extra privileges with --privileged

Solution

The only way to achieve this is to change ASLR configuration on host kernel using:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

Answer 3

So essentially you're right, disabling ASLR is a kernel setting, you'd need to make the change at a kernel level.

There's a couple of options here.

1. Make the change to the host before starting the container.
2. Mount /proc inside the container and make the change from inside the container
3. Use something like KataContainers to run the container with it's own kernel, and then make the change in there.

In theory, all of those should work, but which is good for you will depend on your precise use-case.

Answer 4

For docker on macos, first you need to enter docker desktop Mac VM to modify the kernel config, which can be done with https://gist.github.com/BretFisher/5e1a0c7bcca4c735e716abf62afad389

# enter docker vm
docker run -it --rm --privileged --pid=host justincormack/nsenter1
# disable ASLR
echo 0  > /proc/sys/kernel/randomize_va_space 
# enable ASLR
echo 2  > /proc/sys/kernel/randomize_va_space