4 ms·
I think this is a bit of an overstatement, breaking out of a docker container is not "easy", especially if you add other security products on top. Then there is
by hacknat 11y ago
I think this is a bit of an overstatement, breaking out of a docker container is not "easy", especially if you add other security products on top. Then there is the extensibility of the OS to be used to make things even more secure.
If you look at security through the narrow lens of "being able to break out of your environment" then yes, Hypervisors are more secure, but you have to look at more than just that. The OS allows you to make more than just the host secure, it allows you to make the network secure, ensure that all customers get encrypted disks, etc...
Full disclosure, I work for a company doing this right now (Catalyze Inc.)
- geofft 11y agoYeah, I don't mean to say breaking out of Docker confinement is easy by any objective measure, just that it is much less hard than breaking out of Xen confinement, and even that seems to be a fair bit of concern for AWS already.