{"id":269,"date":"2026-06-26T12:00:00","date_gmt":"2026-06-26T12:00:00","guid":{"rendered":"https:\/\/konteynerium.com\/?p=211"},"modified":"2026-10-06T11:34:00","modified_gmt":"2026-10-06T11:34:00","slug":"rootless-container-nedir-neden-kullanmalisiniz","status":"publish","type":"post","link":"https:\/\/konteynerium.com\/index.php\/2026\/06\/26\/rootless-container-nedir-neden-kullanmalisiniz\/","title":{"rendered":"Rootless Container Nedir? Neden Kullanmal\u0131s\u0131n\u0131z?"},"content":{"rendered":"<p>Docker&#8217;\u0131 varsay\u0131lan ayarlar\u0131yla kurup kullanmaya ba\u015flad\u0131\u011f\u0131n\u0131zda, arka planda root yetkisiyle \u00e7al\u0131\u015fan bir daemon (<code>dockerd<\/code>) vard\u0131r ve \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131z container&#8217;lar da genellikle root kullan\u0131c\u0131s\u0131yla ba\u015flar. Bu, g\u00fcnl\u00fck kullan\u0131m i\u00e7in sorun \u00e7\u0131karmaz, ama g\u00fcvenlik a\u00e7\u0131s\u0131ndan g\u00f6z ard\u0131 edilmemesi gereken bir risktir. <strong>Rootless container<\/strong>, bu riski en ba\u015ftan ortadan kald\u0131rmay\u0131 hedefleyen bir \u00e7al\u0131\u015fma bi\u00e7imidir.<\/p>\n<h2>Neden \u00f6nemli? &#8220;Container ka\u00e7\u0131\u015f\u0131&#8221; riski<\/h2>\n<p>Container&#8217;lar, host i\u015fletim sistemiyle \u00e7ekirde\u011fi (kernel) payla\u015f\u0131r \u2014 sanal makinelerin aksine tam izole de\u011fillerdir. E\u011fer bir container i\u00e7inde \u00e7al\u0131\u015fan uygulamada bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 bulunur ve sald\u0131rgan container&#8217;dan &#8220;ka\u00e7may\u0131&#8221; ba\u015far\u0131rsa, container root yetkisiyle \u00e7al\u0131\u015f\u0131yorsa sald\u0131rgan do\u011frudan <strong>host makinede de root<\/strong> olabilir. Container rootless \u00e7al\u0131\u015f\u0131yorsa, ayn\u0131 ka\u00e7\u0131\u015f olsa bile sald\u0131rgan host&#8217;ta s\u0131radan, yetkisiz bir kullan\u0131c\u0131 olarak kal\u0131r \u2014 sald\u0131r\u0131 y\u00fczeyi ciddi bi\u00e7imde daral\u0131r.<\/p>\n<h2>\u0130ki farkl\u0131 &#8220;rootless&#8221; kavram\u0131n\u0131 ay\u0131rt edin<\/h2>\n<p>Bu konuda s\u0131k kar\u0131\u015fan iki farkl\u0131 seviye vard\u0131r:<\/p>\n<ul>\n<li><strong>Container i\u00e7inde root olmayan kullan\u0131c\u0131:<\/strong> \u0130maj\u0131n\u0131z\u0131, uygulamay\u0131 root yerine s\u0131radan bir kullan\u0131c\u0131yla \u00e7al\u0131\u015ft\u0131racak \u015fekilde yazars\u0131n\u0131z (Dockerfile&#8217;da <code>USER<\/code> talimat\u0131). Daemon yine root&#8217;tur, ama container&#8217;\u0131n kendi i\u00e7indeki s\u00fcre\u00e7 root de\u011fildir.<\/li>\n<li><strong>Rootless Docker daemon&#8217;\u0131:<\/strong> Docker daemon&#8217;\u0131n\u0131n kendisi hi\u00e7 root yetkisi olmadan, s\u0131radan bir kullan\u0131c\u0131 hesab\u0131yla \u00e7al\u0131\u015f\u0131r. Bu, \u00e7ok daha g\u00fc\u00e7l\u00fc bir izolasyon sa\u011flar ama baz\u0131 a\u011f ve depolama \u00f6zellikleri k\u0131s\u0131tlanabilir.<\/li>\n<\/ul>\n<h2>1. Ad\u0131m: Dockerfile&#8217;da root olmayan kullan\u0131c\u0131 tan\u0131mlamak<\/h2>\n<p>En basit ve en s\u0131k uygulanan ad\u0131m budur \u2014 her image&#8217;da yap\u0131labilir, ek kurulum gerektirmez:<\/p>\n<pre><code>FROM node:20-alpine\n\n# Sistem taraf\u0131ndan haz\u0131r gelen 'node' kullan\u0131c\u0131s\u0131na ge\u00e7\nWORKDIR \/app\nCOPY --chown=node:node . .\nRUN npm install --production\n\nUSER node\nEXPOSE 3000\nCMD [\"node\", \"server.js\"]<\/code><\/pre>\n<p>Haz\u0131r bir sistem kullan\u0131c\u0131s\u0131 yoksa kendi kullan\u0131c\u0131n\u0131z\u0131 da olu\u015fturabilirsiniz:<\/p>\n<pre><code>RUN addgroup -S uygulama && adduser -S uygulama -G uygulama\nUSER uygulama<\/code><\/pre>\n<h2>2. Ad\u0131m: Rootless Docker daemon&#8217;\u0131 kurmak<\/h2>\n<p>Docker, resmi olarak rootless kurulum modunu destekler. Kurulum beti\u011fi ile mevcut kullan\u0131c\u0131 hesab\u0131n\u0131z alt\u0131nda, root yetkisi gerektirmeden ayr\u0131 bir daemon ba\u015flat\u0131l\u0131r:<\/p>\n<pre><code>curl -fsSL https:\/\/get.docker.com\/rootless | sh\n\n# Ortam de\u011fi\u015fkenlerini ayarlay\u0131n (kurulum beti\u011fi talimat verir)\nexport PATH=\/home\/kullanici\/bin:$PATH\nexport DOCKER_HOST=unix:\/\/\/run\/user\/1000\/docker.sock\n\ndocker run hello-world<\/code><\/pre>\n<p>Bu modda daemon, host&#8217;ta hi\u00e7bir zaman root yetkisine sahip olmaz \u2014 kullan\u0131c\u0131 ad alanlar\u0131 (<em>user namespaces<\/em>) sayesinde container i\u00e7indeki &#8220;root&#8221; kullan\u0131c\u0131, host&#8217;ta sizin s\u0131radan kullan\u0131c\u0131 kimli\u011finize e\u015flenir.<\/p>\n<div class=\"callout\">\n  <span class=\"glyph\">i<\/span><\/p>\n<p>Podman, rootless \u00e7al\u0131\u015fmay\u0131 en ba\u015f\u0131ndan beri varsay\u0131lan olarak sunar ve ayr\u0131ca bir daemon&#8217;a da ihtiya\u00e7 duymaz. Rootless g\u00fcvenli\u011fi \u00f6ncelikli bir gereksiniminiz varsa Docker&#8217;\u0131 rootless modda \u00e7al\u0131\u015ft\u0131rmakla Podman&#8217;a ge\u00e7mek aras\u0131nda se\u00e7im yapabilirsiniz \u2014 ikisinin kar\u015f\u0131la\u015ft\u0131rmas\u0131n\u0131 <a href=\"https:\/\/konteynerium.com\/index.php\/karsilastirma\/docker-vs-podman-hangisini-secmelisiniz\/\">Docker vs Podman<\/a> yaz\u0131m\u0131zda bulabilirsiniz.<\/p>\n<\/div>\n<h2>Nelere dikkat etmeli?<\/h2>\n<ul>\n<li><strong>1024 alt\u0131 portlar:<\/strong> Rootless modda varsay\u0131lan olarak 80, 443 gibi &#8220;ayr\u0131cal\u0131kl\u0131&#8221; portlara do\u011frudan ba\u011flanamazs\u0131n\u0131z; bunun yerine 8080 gibi bir port kullan\u0131p \u00f6n\u00fcne bir reverse proxy koymak yayg\u0131n \u00e7\u00f6z\u00fcmd\u00fcr.<\/li>\n<li><strong>Performans:<\/strong> A\u011f ve dosya sistemi katman\u0131nda ek bir soyutlama oldu\u011fu i\u00e7in rootless modda k\u00fc\u00e7\u00fck bir performans fark\u0131 olabilir; \u00e7o\u011fu uygulama i\u00e7in bu fark fark edilmez.<\/li>\n<li><strong>\u00dcretimde kademeli ge\u00e7i\u015f:<\/strong> \u00d6nce container i\u00e7i <code>USER<\/code> talimat\u0131n\u0131 (1. ad\u0131m) t\u00fcm imajlar\u0131n\u0131za uygulamak, rootless daemon&#8217;a ge\u00e7mekten (2. ad\u0131m) \u00e7ok daha kolay ve d\u00fc\u015f\u00fck riskli bir ba\u015flang\u0131\u00e7t\u0131r.<\/li>\n<\/ul>\n<p>Rootless \u00e7al\u0131\u015fmak, sald\u0131r\u0131 y\u00fczeyini daraltman\u0131n sadece bir par\u00e7as\u0131d\u0131r. Bir sonraki ad\u0131m genellikle \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131z imajlar\u0131n i\u00e7inde bilinen g\u00fcvenlik a\u00e7\u0131\u011f\u0131 olup olmad\u0131\u011f\u0131n\u0131 kontrol etmektir \u2014 bu konuyu bir sonraki yaz\u0131da, container image g\u00fcvenli\u011fi ba\u015fl\u0131\u011f\u0131 alt\u0131nda ele al\u0131yoruz.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Root yetkisiyle \u00e7al\u0131\u015fan container&#8217;lar\u0131n neden risk ta\u015f\u0131d\u0131\u011f\u0131n\u0131, Dockerfile&#8217;da USER talimat\u0131ndan rootless Docker daemon kurulumuna kadar ad\u0131m ad\u0131m g\u00fcvenli\u011fi nas\u0131l art\u0131raca\u011f\u0131n\u0131z\u0131 \u00f6\u011frenin.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"seviye":[8],"class_list":["post-269","post","type-post","status-publish","format-standard","hentry","category-orkestrasyon-guvenlik","seviye-orta"],"_links":{"self":[{"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/posts\/269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/comments?post=269"}],"version-history":[{"count":1,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/posts\/269\/revisions"}],"predecessor-version":[{"id":570,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/posts\/269\/revisions\/570"}],"wp:attachment":[{"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/media?parent=269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/categories?post=269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/tags?post=269"},{"taxonomy":"seviye","embeddable":true,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/seviye?post=269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}