18 ms·
SELinux is NOT isolation. The main issue is the large kernel attack surface and SELinux, while important, only solves a small part of that.
by lima 10y ago
SELinux is NOT isolation. The main issue is the large kernel attack surface and SELinux, while important, only solves a small part of that.
- nailer 10y agoThat's true, but a lot of the classic containers-not-containing issues (/sysfs hacks to get into the parent kernel etc) are prevented by SELinux policies. See https://blog.openshift.com/securing-dockers-future-with-selinux-and-the-open-source-way/ https://blog.openshift.com/securing-dockers-future-with-seli...
- lima 10y agoAgreed. But people keep selling SELinux or AppArmor as a solution for multi-tenant container environments, which is just plain false. The real solution are efforts like like Intel's Clear Containers and Hyper's runV.