4 ms·
Would it be possible/make sense to use Docker for this? Using something like Whalebrew? https://github.com/bfirsh/whalebrew https://github.com/bfirsh/whalebrew
by vnglst 10y ago
Would it be possible/make sense to use Docker for this?
Using something like Whalebrew? https://github.com/bfirsh/whalebrew https://github.com/bfirsh/whalebrew
- asimpletune 10y agoDo you mean to implement this with Docker or just to use Docker with this OS?
- segmondy 10y agoNo, Docker is not built for security. I do use Docker sometimes to isolate processes, but not for serious security.
- meetri 10y agoif properly configured why not? What would stand in the way of implementing a secure containerized version of the workstation+gateway type setup?
- sebcat 10y agoYou could break out of the isolation by using kernel vulnerabilities, e.g., in syscalls.
- __jal 10y agoTheoretically, nothing. In practice, the isolation it relies on is somewhat weak. And in general, it is new and exciting and changing frequently, which means security bugs. Also, most people seem to rather suck at configuring it, as far as I've seen. (That's not per se a problem with Docker, but it is frequently a problem with Docker as-deployed.) And then there are potential kernel bugs. When talking about "trusting X", one always has to answer the question "trust X to do what, exactly, under what circumstances?" I don't yet trust Docker to be secure enough for production, internet-exposed business use. I know other people disagree; YMMV.
- AlexCoventry 10y agonth'ing the other warnings about this approach, but thanks for mentioning whalebrew. Looks very interesting.