4 ms·
If you put Apache and Postgres into the same cgroup/pid namespace/mount namespace/network namespace, an attack on Apache could result in access to the mount nam
by audidude 11y ago
If you put Apache and Postgres into the same cgroup/pid namespace/mount namespace/network namespace, an attack on Apache could result in access to the mount namespace of your Postgres. (Presumably that is something you are trying to prevent).
- _delirium 11y agoI think what the comment you're replying to was saying is that even putting just one of them in a container would violate the rules here, because Apache and Postgres are multi-process applications (at least in many common configurations), and the rules say flat-out no more than one process.
- lwf 11y agoReferring to these as "rules" when they aren't is exactly what great-grandparent was warning against: > […] will always end up being dogmatized and multiplying complexity needlessly. If more than one process helps you get your job done, great. If it's all one self-contained application, go for it. You start feeling the pain when you have unrelated or loosely-coupled applications in the same container.