5 ms·
root is root. containers that run as root are no more secure than chroot.. ( see : docker )
by geggam 11y ago
root is root.
containers that run as root are no more secure than chroot..
( see : docker )
- ithkuil 11y agois this true? I understand that the attack surface of a cgroup based container is bigger than a VM, but saying that just running processes as root in contains is not more secure than chroot begs at least for some reference.
- tyingq 11y agoI believe that "root is root" is just shorthand for... If you aren't using unprivileged containers, then the only approach you have for making the container more secure than chroot is a whack-a-mole style approach. By whack-a-mole, I mean trying to map out the attack surface, and using a hodge podge of tools to try and close them (kernel cap-drops, apparmor, se-linux, firewall rules, overlay mounts for /proc, /sys, etc). I think it's reasonable to say that the whack-a-mole approach isn't truly more secure. In the same way that having a vault door on the front of your house, next to an open window isn't any more secure than having the door wide open.