3 ms·
Nit; a (Linux) chroot is not a jail. A bsd jail is more like an lxc container.
by e12e 10y ago
Nit; a (Linux) chroot is not a jail. A bsd jail is more like an lxc container.
- sh_tinh_hair 10y agoUnderstood. Same privilege escalation applies. ..and the syscall chroot is used between systems as a primitive in either os space and semantic.
- Drdrdrq 10y agoExcept AFAIK jail is meant to be secure while lxc (or at least docker) containers are not. Right?
- e12e 10y agoLxc has since 1.0 come with isolation and security as part of it's design and feature set. Docker started as a convenient approach to bundling up chroots - and AFAIK hasn't really made much of a real effort wrt security - other than somewhat ill-advised approach to tacking on (enabling) a feature here or there... (That's not counting external projects like rkt running images as vms etc). Lxc is much closer to jails in that sense - but eg lxc/Lxd on Ubuntu is hardly (meant to be) a silver bullet.
- jeffgus 10y agoYeah, docker, initially, didn't use SELinux, but that was before RedHat took interest. RedHat likes making things more secure with SELinux.