3 ms·
Is that really true? I have always read that cgroups based containerization on Linux is kind of a joke and that root in the container more or less equals root o
by api 10y ago
Is that really true? I have always read that cgroups based containerization on Linux is kind of a joke and that root in the container more or less equals root on the host.
Has there been significant improvement in this area lately?
- ralmeida 10y agoI'm not familiar with that perception, any good reads on that?
- raesene9 10y agotends to be much older articles that had that perception, pre userns, seccomp, extended cgroup support etc.
- wmf 10y agoThe fix for that is user namespaces which is (finally) included in Docker. So yes, it has gotten better.