5 ms·

I see nothing wrong with this. I think it's good to be specific. The Linux implementation is different from many other containerization solutions (eg, Solaris

I see nothing wrong with this. I think it's good to be specific. The Linux implementation is different from many other containerization solutions (eg, Solaris Zones, AIX WPAR, HPUX partitions, etc, so forth). The scope of "all container solutions for every platform" is too broad to be able to provide much depth, and the audience of people interested in container information for all platforms instead of a specific platform is fairly narrow. There's plenty of room for someone to make a document specific to other platforms for a different audience. There's even room for someone to make a comparison of all platforms. It depends on your goal, your knowledge, and your intended audience.

X86BSD 11y ago
It's not that the paper is wrong for only focusing on Linux "containers". It's that the paper, while describing the security short comings of the various solutions, illustrates the echo chamber I refer to. "We have these security issues, that others do not have, but we are not going to look at how they solved these issues because, well, Linux!" The paper, IMO, would have better served the audience had it included ideas and/or solutions people outside Linux-land developed to solve some of these issues that were written before Linux even attempted a "container". You are free to disagree.
- Scarbutt 11y ago
  and how do you know the others solutions are really secure? Linux is going to get the most eyes, critics, scrutiny on this because is way more widely used than the other platforms that provide similar technologies.
  - AdieuToLogic 11y ago
    and how do you know the others solutions are really secure? Linux is going to get the most eyes, critics, scrutiny on this because is way more widely used ... This is commonly known as the "given enough eyeballs" fallacy[1]. While it might help when more people have an opportunity to review security critical subsystems, a given OS' popularity certainly does not guarantee this. Heartbleed[2] is often cited as an exemplar for this very situation. 1 - http://www.amazon.com/Facts-Fallacies-Software-Engineering-Robert/dp/0321117425 http://www.amazon.com/Facts-Fallacies-Software-Engineering-R... 2 - https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed
  - pyvpx 11y ago
    other than something like seL4, no one _knows_ what is really secure. however it would be hard to argue that a decade+ of container systems such as FreeBSD Jail and Solaris' functional equivalent (the precise name escapes me) don't have useful lessons "Linux can learn from".
  - dap 11y ago
    Because not only did the engineers who built it consider how the architecture would ensure security, they wrote all of the considerations and design choices down.[1] Even if they were completely wrong about everything, there's no reason to simply ignore all the thought that's been put into this problem. [1] https://us-east.manta.joyent.com/bcantrill/public/ppwl-cantrill-zones.pdf https://us-east.manta.joyent.com/bcantrill/public/ppwl-cantr...
  - i4k 11y ago
    Linux being secure is a fallacy too. Spender talks about it for a long time: https://grsecurity.net/~spender/interview_notes.txt https://grsecurity.net/~spender/interview_notes.txt Linux developers fix security bugs in irresponsible ways, saying nothing about the attack vector or CVE's involved. Sometimes multiple vulnerabilities are addressed in the same patch, making hard to track the fix. For more information see the exploit below: https://grsecurity.net/~spender/exploits/64bit_dos.c https://grsecurity.net/~spender/exploits/64bit_dos.c The list of kernel vulnerabilities involving namespaces is bigger each day, as the paper shows, but the industry still uses "container" and "security" in the same quotes.

X86BSD 11y ago

It's not that the paper is wrong for only focusing on Linux "containers". It's that the paper, while describing the security short comings of the various solutions, illustrates the echo chamber I refer to. "We have these security issues, that others do not have, but we are not going to look at how they solved these issues because, well, Linux!" The paper, IMO, would have better served the audience had it included ideas and/or solutions people outside Linux-land developed to solve some of these issues that were written before Linux even attempted a "container". You are free to disagree.

Scarbutt 11y ago
and how do you know the others solutions are really secure? Linux is going to get the most eyes, critics, scrutiny on this because is way more widely used than the other platforms that provide similar technologies.
- AdieuToLogic 11y ago
  and how do you know the others solutions are really secure? Linux is going to get the most eyes, critics, scrutiny on this because is way more widely used ... This is commonly known as the "given enough eyeballs" fallacy[1]. While it might help when more people have an opportunity to review security critical subsystems, a given OS' popularity certainly does not guarantee this. Heartbleed[2] is often cited as an exemplar for this very situation. 1 - http://www.amazon.com/Facts-Fallacies-Software-Engineering-Robert/dp/0321117425 http://www.amazon.com/Facts-Fallacies-Software-Engineering-R... 2 - https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed
- pyvpx 11y ago
  other than something like seL4, no one _knows_ what is really secure. however it would be hard to argue that a decade+ of container systems such as FreeBSD Jail and Solaris' functional equivalent (the precise name escapes me) don't have useful lessons "Linux can learn from".
- dap 11y ago
  Because not only did the engineers who built it consider how the architecture would ensure security, they wrote all of the considerations and design choices down.[1] Even if they were completely wrong about everything, there's no reason to simply ignore all the thought that's been put into this problem. [1] https://us-east.manta.joyent.com/bcantrill/public/ppwl-cantrill-zones.pdf https://us-east.manta.joyent.com/bcantrill/public/ppwl-cantr...
- i4k 11y ago
  Linux being secure is a fallacy too. Spender talks about it for a long time: https://grsecurity.net/~spender/interview_notes.txt https://grsecurity.net/~spender/interview_notes.txt Linux developers fix security bugs in irresponsible ways, saying nothing about the attack vector or CVE's involved. Sometimes multiple vulnerabilities are addressed in the same patch, making hard to track the fix. For more information see the exploit below: https://grsecurity.net/~spender/exploits/64bit_dos.c https://grsecurity.net/~spender/exploits/64bit_dos.c The list of kernel vulnerabilities involving namespaces is bigger each day, as the paper shows, but the industry still uses "container" and "security" in the same quotes.