3 ms·
So its similar Docker, except they don't use some base image from the cloud, but use the host instead. The known security weakness of Docker (and containers in
by qznc 10y ago
So its similar Docker, except they don't use some base image from the cloud, but use the host instead.
The known security weakness of Docker (and containers in general) is that the host kernel is exposed. Capsule somehow "copies" the host kernel in flight?
- IChrisI 10y agoThinstall did something similar; I've used it in the past and it worked pretty well. It captures system calls and writes changes to its own storage, and when a program reads a directory or file or registry key, it presents a combined view of the host OS + that program's changes, so programs think they are fully, normally installed. https://en.wikipedia.org/wiki/VMware_ThinApp https://en.wikipedia.org/wiki/VMware_ThinApp
- walterbell 10y agoOne difference from Docker is that Cappsule uses hardware virtualization, so the isolation is that of a VM rather than kernel namespace. The VM gets a private, copy-on-write instance of the host kernel. From their FAQ: "Docker isn’t meant for security. While a lot of improvements have been made recently in this area, it also relies on Linux namespaces and SECCOMP to ensure container isolation. A single kernel vulnerability allows an attacker to compromise the host. On this topic, the chapter 7 (Understanding Container Threats) of NCC Group Whitepaper Understanding and Hardening Linux Containers is a must-read," https://www.nccgroup.trust/us/our-research/understanding-and-hardening-linux-containers/ https://www.nccgroup.trust/us/our-research/understanding-and...