4 ms·
I'm not sure what you mean here. Do you mean that: 1) There are known ways to perform Docker escapes on any or some common Docker setup. You could write a Dock
by DCKing 9y ago
I'm not sure what you mean here. Do you mean that:
1) There are known ways to perform Docker escapes on any or some common Docker setup. You could write a Docker escape binary or script today and it would not be a zero day. That's just the way Docker is.
-or-
2) You simply have less faith in the ways Docker performs isolation. One could write a Docker escape exploit and it would be a zero day, but you expect there to be more of such zero days in Docker than in Jails/Zones.
?
If 1) I'd be really interested in seeing it and if 2) I'd like to know more about what additional levels of isolation jails and zones (and LXC?) perform.
- mirashii 9y agoI've expanded a little bit more in another comment here, but I think 2) is less a case of any fundamentally different level of isolation, but more a maturity of design and implementation. While Zones were designed as first class, containers were not, they're built out of a variety of other building blocks, which while they may be more powerful primitives, have seen less review of design and implementation and exposed a large attack space on the kernel. User namespaces are the prime example, possibly because they are the largest/juiciest new target, but I expect we'll see more with time.