3 ms·

I don't do Docker but from what I've heard it's not designed for security? Which means it wouldn't work for this scenario? Or am I misinformed?

icebraining 9y ago
Docker is just regular processes limited by a bunch of Linux kernel isolation mechanisms, which means that you're subject to potential kernel exploits, which would allow a "neighbor" container to run code outside the container and then control your own. There are some ways of mitigating this, but the simplest one would be for the provider to run a VM for each container, then you get the security guarantees of regular VMs (though you still have to trust the provider to keep the OS up to date).
- marktangotango 9y ago
  Is a docker container simply a process or is it more heavy weight than that? It certainly can be, so isn't this characterization that it's merely a "process" a bit disingenuous? https://unix.stackexchange.com/questions/216618/what-do-the-processes-inside-a-docker-container-look-like https://unix.stackexchange.com/questions/216618/what-do-the-...
  - icebraining 9y ago
    Processes, not process, and I was talking in terms of security, but even in terms of performance, yes, it mostly is. There are some Docker features that can be more expensive (NAT and layered filesystem), but they are optional. A "Docker container" itself is just a group of processes to which the kernel applies a different policy than the default. I'm not sure what that link is supposed to show, can you be more clear?
rdsubhas 9y ago
Security without context is ambiguous and vague. To the parent comment - which asks about shipping and paying for "M" processes, docker is a reasonable (if not great) solution as container/namespace/process isolation are all, one way or another, sharing the same kernel and have mostly the same benefits/drawbacks.
- aarongolliver 9y ago
  I think "Security" in this context would roughly mean "able to run code from >1 user as securely (or more) than if they were running on separate VMs". Which AFAICT docker & linux cannot provide, but something like triton can.
CyberDildonics 9y ago
> I don't do Docker but from what I've heard it's not designed for security? Which means it wouldn't work for this scenario? Are you asking if that's what you've heard?

icebraining 9y ago

Docker is just regular processes limited by a bunch of Linux kernel isolation mechanisms, which means that you're subject to potential kernel exploits, which would allow a "neighbor" container to run code outside the container and then control your own. There are some ways of mitigating this, but the simplest one would be for the provider to run a VM for each container, then you get the security guarantees of regular VMs (though you still have to trust the provider to keep the OS up to date).

marktangotango 9y ago
Is a docker container simply a process or is it more heavy weight than that? It certainly can be, so isn't this characterization that it's merely a "process" a bit disingenuous? https://unix.stackexchange.com/questions/216618/what-do-the-processes-inside-a-docker-container-look-like https://unix.stackexchange.com/questions/216618/what-do-the-...
- icebraining 9y ago
  Processes, not process, and I was talking in terms of security, but even in terms of performance, yes, it mostly is. There are some Docker features that can be more expensive (NAT and layered filesystem), but they are optional. A "Docker container" itself is just a group of processes to which the kernel applies a different policy than the default. I'm not sure what that link is supposed to show, can you be more clear?

rdsubhas 9y ago

Security without context is ambiguous and vague. To the parent comment - which asks about shipping and paying for "M" processes, docker is a reasonable (if not great) solution as container/namespace/process isolation are all, one way or another, sharing the same kernel and have mostly the same benefits/drawbacks.

aarongolliver 9y ago
I think "Security" in this context would roughly mean "able to run code from >1 user as securely (or more) than if they were running on separate VMs". Which AFAICT docker & linux cannot provide, but something like triton can.

CyberDildonics 9y ago

> I don't do Docker but from what I've heard it's not designed for security? Which means it wouldn't work for this scenario? Are you asking if that's what you've heard?