3 ms·
There are also many services like heroku that offer customers a container that's multi-tenent with many other containers. You could break out of yours and exam
by TheDong 10y ago
There are also many services like heroku that offer customers a container that's multi-tenent with many other containers.
You could break out of yours and examine the filesystem of other's and steal whatever valuables you wish to.
- pmontra 10y agoYou are right, I didn't think about that.
- majewsky 10y agoThat's why it is considered a best practice to implement multitenancy via VMs: Every customer gets their own set of VMs where their containers are scheduled. If an application breaks out of the container isolation, at least it can only see other stuff from the same customer because the VM offers an additional isolation layer that's more battle-tested.