Device access

When a container can see host device nodes under /dev, either from --privileged or an explicit --device, the kernel device drivers behind those nodes operate on host hardware regardless of namespaces. Mounting the host block device, reading raw kernel memory devices, or creating new device nodes with mknod each lead from the container to the host.

1 ನಿಮಿಷದ ಓದುಅಕ್ಟೋ 5,2026 ರಂದು ನವೀಕರಿಸಲಾಗಿದೆflorianamette1 ಕೊಡುಗೆದಾರ
ನಿಮ್ಮ ಸಹಾಯಕವನ್ನು ಕೇಳಿ (MCP)GitHub ನಲ್ಲಿ ಸಂಪಾದಿಸಿ

Device nodes are the container's direct line to host hardware. A device node is only a reference to a driver identified by a major and minor number; the driver itself runs in the shared host kernel and acts on the real device, so a block-device node in a container reads the host's actual disk, not a namespaced copy. A container gets dangerous device nodes from --privileged (which adds a device cgroup rule allowing all devices) or from a targeted --device=/dev/sda, and in Kubernetes from a volumeDevices raw block claim.

Enumerate what is reachable:

bash
ls -l /dev                              # long list with sdX/nvme/mem hints at broad access
cat /sys/fs/cgroup/devices/devices.list 2>/dev/null   # cgroup v1 device allowlist; "a *:* rwm" = all
lsblk 2>/dev/null; cat /proc/partitions # host block devices and sizes

A line of a *:* rwm in the device cgroup, or visible sda/nvme0n1 nodes, means the host disk is one mount away.

Subtopics#

  • Host block device: mount the host root filesystem and chroot in.
  • Kernel memory devices: read and write RAM through /dev/mem and friends.
  • mknod: recreate a device node when the path is missing but the capability is present.

References#

ಹಿಂದಿನದುcgroups release_agentಮುಂದಿನದು Host block device