3 ms·
Well, no, it doesn't have privilege isolation. But it does have isolation from a fault tolerance perspective which I admit is only a portion of the purpose of i
by infogulch 10y ago
Well, no, it doesn't have privilege isolation. But it does have isolation from a fault tolerance perspective which I admit is only a portion of the purpose of isolation.
But if you're deliberately running malicious code even cgroups/namespaces won't save you from some attacks. Timing and cache attacks can be done without breaking out of the jail.
- derefr 10y agoNot deliberately running malicious code, no; but deliberately running user-supplied code, yes. A properly isolated container system (whether at the OS or the runtime level) allows one system to serve as host for the programmatic equivalent of members of two rival gangs (mutually-untrustworthy processes), without anyone "getting shot."
- infogulch 10y agoSeparating "malicious code" from "user-supplied code" is a distinction without a difference. I would say one member having their private keys stolen[1] is a "fatal shot". [1]: https://news.ycombinator.com/item?id=11891579 https://news.ycombinator.com/item?id=11891579