3 ms·
Except AFAIK jail is meant to be secure while lxc (or at least docker) containers are not. Right?
by Drdrdrq 10y ago
Except AFAIK jail is meant to be secure while lxc (or at least docker) containers are not. Right?
- e12e 10y agoLxc has since 1.0 come with isolation and security as part of it's design and feature set. Docker started as a convenient approach to bundling up chroots - and AFAIK hasn't really made much of a real effort wrt security - other than somewhat ill-advised approach to tacking on (enabling) a feature here or there... (That's not counting external projects like rkt running images as vms etc). Lxc is much closer to jails in that sense - but eg lxc/Lxd on Ubuntu is hardly (meant to be) a silver bullet.
- jeffgus 10y agoYeah, docker, initially, didn't use SELinux, but that was before RedHat took interest. RedHat likes making things more secure with SELinux.