> Mount namespaces and user namespaces have been a ripe area for Linux exploits. If you disable user namespaces, then only privileged users can create mount na

> Mount namespaces and user namespaces have been a ripe area for Linux exploits. If you disable user namespaces, then only privileged users can create mount namespaces. The rest of your tirade about namespaces is based on a misunderstanding of how namespaces are privilege separated. > seccomp doesn't save containers. It has zero to do with containers. It's a simple mechanism to limit syscalls by syscall number. ... There is also seccomp-bpf -- which allows you to write proper filters for syscalls. Which makes the statement "simple mechanism" wildly inaccurate. > Regarding PID namespacing and signaling, that's just FUD about chroot jails. I note that you ignored my mention that most chroot jails have to mount /proc (and other filesystems that you seem to think are somehow dangerous), and also that networking isn't namespaced with chroot. Isn't that funny. chroot was a very clever hack made by Bill Joy to be able to compile 4.2 BSD on a 4.1 BSD machine. Pretending that it's a genius security measure is just being disingenuous. BSD Jails, Solaris Zones and Linux Containers are all extensions of the base idea (lying to processes) -- but it's really quite silly to pretend that chroot is somehow superior to more modern operating system virtualisation systems because it's _simpler_.