3 ms·
Which implementation of containers are a "quickly emerging part of the kernel security landscape"? Im seriously asking because cgroups and jails have been aroun
by akiselev 11y ago
Which implementation of containers are a "quickly emerging part of the kernel security landscape"? Im seriously asking because cgroups and jails have been around for a very long time and, unlike LXC so far (for all intents and purposes, given that Docker is the most popular implementation), actually provide real security instead of dependency and devops management poorly disguised as security.
Maybe times have changed in the last year since I've used LXC containers, but when I explored them they were about as secure in practice as a paper bag is waterproof.
- ybx 11y agoWell for one, LXC isn't necessarily a "thing" in itself - it's a combination of several Linux kernel systems (one of which is cgroups) that together provide machine-like containers.
- jitl 11y agoWindows is doing a lot of work using their hypervisor to secure parts of the kernel -- This talk from Blackhat 2015 has some really cool details: http://www.alex-ionescu.com/blackhat2015.pdf http://www.alex-ionescu.com/blackhat2015.pdf