6 ms·

Seccomp, apparmor, and namespacing (especially user!) do add a lot more security than plain old chroots, but still not at the level of a VM.

cm2187 10y ago
But couldn't containers have been designed that way? One thing I have in mind is one of windows 10 recent features, which consist in running certain applications using the same hardware level memory protection mechanism than VMs, so that the application is safe from the OS/Kernel, and the OS/Kernel is safe from the application (can't find the exact name for this new feature unfortunately).
- daenney 10y ago
  Containers can't be designed that way as long as the primitives to build them that way (which are mostly part of the Linux kernel) are missing. That's a core part of the article. Containers aren't an entity by themselves, they're a clever and useful combination of an existing set of capabilities.
- emmelaich 10y ago
  You can design all you like, but implementation takes work. Seccomp only landed for Docker in about 1.12
- di4na 10y ago
  It is like that... but in Zones or Jails, not in Linux "container toolkit"
  - bonzini 10y ago
    No, the Windows 10 feature he's talking about uses Hyper-V internally. It's called, unsurprisingly, Hyper-V containers: https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container https://docs.microsoft.com/en-us/virtualization/windowsconta...
    - cm2187 10y ago
      Actually I found it. It's called Windows 10 Virtual Secure mode https://channel9.msdn.com/Blogs/Seth-Juarez/Windows-10-Virtual-Secure-Mode-with-David-Hepkin https://channel9.msdn.com/Blogs/Seth-Juarez/Windows-10-Virtu... (or Windows 10 isolated user mode, which seems kind of similar) https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Crede...
      - bonzini 10y ago
        Oh yeah that's another use of Hyper-V, somewhat similar to ARM TrustZone. It's used to implement "Credential Guard".

cm2187 10y ago

But couldn't containers have been designed that way? One thing I have in mind is one of windows 10 recent features, which consist in running certain applications using the same hardware level memory protection mechanism than VMs, so that the application is safe from the OS/Kernel, and the OS/Kernel is safe from the application (can't find the exact name for this new feature unfortunately).

daenney 10y ago
Containers can't be designed that way as long as the primitives to build them that way (which are mostly part of the Linux kernel) are missing. That's a core part of the article. Containers aren't an entity by themselves, they're a clever and useful combination of an existing set of capabilities.
emmelaich 10y ago
You can design all you like, but implementation takes work. Seccomp only landed for Docker in about 1.12
di4na 10y ago
It is like that... but in Zones or Jails, not in Linux "container toolkit"
- bonzini 10y ago
  No, the Windows 10 feature he's talking about uses Hyper-V internally. It's called, unsurprisingly, Hyper-V containers: https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container https://docs.microsoft.com/en-us/virtualization/windowsconta...
  - cm2187 10y ago
    Actually I found it. It's called Windows 10 Virtual Secure mode https://channel9.msdn.com/Blogs/Seth-Juarez/Windows-10-Virtual-Secure-Mode-with-David-Hepkin https://channel9.msdn.com/Blogs/Seth-Juarez/Windows-10-Virtu... (or Windows 10 isolated user mode, which seems kind of similar) https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Crede...
    - bonzini 10y ago
      Oh yeah that's another use of Hyper-V, somewhat similar to ARM TrustZone. It's used to implement "Credential Guard".