10 ms·

> You may be able to guarantee this with a VM but you certainly cannot guarantee it with a container. Don't group all container implementations into one catego

> You may be able to guarantee this with a VM but you certainly cannot guarantee it with a container. Don't group all container implementations into one category. You could certainly use FreeBSD Jails and Illumos Zones for isolating apps.

pmoriarty 9y ago
Those solutions still allow the host and all the other containers to be compromised through a kernel exploit, though, can't they? The most secure isolation is provided with physical separation. Second best is VMs. Containers are a distant third.
- 2trill2spill 9y ago
  > Those solutions still allow the host and all the other containers to be compromised through a kernel exploit, though, can't they? If I keep my boxes up to date I only need to worry about zero day kernel exploits. So if someone comes along and uses a zero day kernel exploit to escape my FreeBSD jail then they were going to get on the box anyway, because any attacker using a zero day is highly skilled and highly targeted. > The most secure isolation is provided with physical separation. Second best is VMs. Containers are a distant third. While I agree that physical isolation is the safest, I don't think it's so cut and dry between containers and VMs. Virtual machines have significantly more attack surface than either Jails or Zones, think of all the emulated devices.
  - pmoriarty 9y ago
    "Virtual machines have significantly more attack surface than either Jails or Zones, think of all the emulated devices." Nothing prevents you from using jails or zones in your VM.
    - 2trill2spill 9y ago
      > Nothing prevents you from using jails or zones in your VM. I get that but that's no longer VMs vs containers, Thats VM plus container vs container.
- Spivak 9y ago
  > Second best is VMs. Containers are a distant third. I will grant you that containers are harder to isolate since it's same problem as isolating individual processes. But there isn't really a meaningful difference between a kernel exploit and a hypervisor exploit.
  - kijiki 9y ago
    Attack surface of a minimal hypervisor is way smaller than that of an entire kernel. Take a look at Clear Containers (despite the name, actually using VMs) and their qemu-lite minimal machine type.
- depr 9y ago
  What makes you say that? VM's get exploited as well http://venom.crowdstrike.com http://venom.crowdstrike.com so what makes you think VM's are better than e.g. zones?

pmoriarty 9y ago

Those solutions still allow the host and all the other containers to be compromised through a kernel exploit, though, can't they? The most secure isolation is provided with physical separation. Second best is VMs. Containers are a distant third.

2trill2spill 9y ago
> Those solutions still allow the host and all the other containers to be compromised through a kernel exploit, though, can't they? If I keep my boxes up to date I only need to worry about zero day kernel exploits. So if someone comes along and uses a zero day kernel exploit to escape my FreeBSD jail then they were going to get on the box anyway, because any attacker using a zero day is highly skilled and highly targeted. > The most secure isolation is provided with physical separation. Second best is VMs. Containers are a distant third. While I agree that physical isolation is the safest, I don't think it's so cut and dry between containers and VMs. Virtual machines have significantly more attack surface than either Jails or Zones, think of all the emulated devices.
- pmoriarty 9y ago
  "Virtual machines have significantly more attack surface than either Jails or Zones, think of all the emulated devices." Nothing prevents you from using jails or zones in your VM.
  - 2trill2spill 9y ago
    > Nothing prevents you from using jails or zones in your VM. I get that but that's no longer VMs vs containers, Thats VM plus container vs container.
Spivak 9y ago
> Second best is VMs. Containers are a distant third. I will grant you that containers are harder to isolate since it's same problem as isolating individual processes. But there isn't really a meaningful difference between a kernel exploit and a hypervisor exploit.
- kijiki 9y ago
  Attack surface of a minimal hypervisor is way smaller than that of an entire kernel. Take a look at Clear Containers (despite the name, actually using VMs) and their qemu-lite minimal machine type.
depr 9y ago
What makes you say that? VM's get exploited as well http://venom.crowdstrike.com http://venom.crowdstrike.com so what makes you think VM's are better than e.g. zones?