4 ms·
This has been my complaint from day one. Instead of docker have something like ports or pkgsrc and simply create tools that simplify sandboxing, like cgexec, a
by nwmcsween 8y ago
This has been my complaint from day one. Instead of docker have something like ports or pkgsrc and simply create tools that simplify sandboxing, like cgexec, a google kafel -> ebpf filter then all the package manager has to do is well package. Docker IMO is a mudball of concerns that need to be separated.
- gm-conspiracy 8y agoBSD jails?
- kazen44 8y agojails are actually very mature if you compare them to docker. They have a well working security system and sane networking. (docker just does endless NAT abstraction, which is terrible for certain use cases. Not to mention it breaks a ton of useful networking features)
- gm-conspiracy 8y agoI was asking a coworker the other day about using containers with a "shared" mapped filesystem subdirectory for UNIX file socket communication versus encapsulating everything in a TCP/IP network stack, but my coworker was concerned about the security risks of a mapped filesystem on the containers. I sometimes feel like a crazy person.
- nwmcsween 8y agoI don't know enough about BSD to really comment but do any of them have resource and syscall limiting (xgroips, seccomp) like functionality? IMO it should be mandatory for distributed application bundles.
- auslander 8y agoOpenBSD pledge
- auslander 8y agoSElinux, kernel namespaces and syscalls for Docker seccomp profiles. Docker is not production ready yet.