3 ms·

I never understood why container security needs to be treated differently then regular security for the os and process.

• tyingq 10y ago
  One difference would be that containers have the need to try and prevent escaping the container and mucking with the host os.
• digi_owl 10y ago
  Because they are effectively turning into a mini-os. The whole container hype is an offshot of the VM hype from a few years back, that was all about running multiple, apparently separate, servers on shared hardware. This by doing the OS and server installs into VM images that would be managed by hypervisors (effectively a stripped down OS that only existed to run VMs). The VM approach have certain issues with overhead, as you are running multiple kernels and user spaces stacked on top of each other, with the underlying CPU spending time pretending to be whatever hardware the VM is presenting to the OS within it. Thus you get containers, a chroot on steroids that is claiming to bring some of the benefits of VM (less idle hardware, thus getting all the accountants hot and bothered) but with reduced overhead. This by having the containers share kernel and general userspace. Frankly we keep adding turtles to the stack. We start out with a single cpu running a single process. Then we stack multiple cpus into racks. Then we implement timeshare so that each cpu can run multiple processes. Then we virtualize the cpu into a process, that in turn are timesharing processes. All this because hardware takes up space and electricity even while idle, but software do not. Thus the more software you can run on a single piece of hardware the "better".