3 ms·
AFAIK Docker is still not considered ready to run untrusted code on shared machines. If you want to run untrusted code, you should just use a VM anyway.
by andrewstuart2 10y ago
AFAIK Docker is still not considered ready to run untrusted code on shared machines. If you want to run untrusted code, you should just use a VM anyway.
- raesene6 10y agoEven with a VM you need to be somewhat careful as hypervisor breakouts are not unknown.
- jeffmcjunkin 10y agoAbsolutely. That said, the Linux kernel is a helluva lot more attack surface than the relatively few hypercalls provided by most Type 1 hypervisors.