3 ms·
If the same compromised app is running natively then the entire system is now compromised. Capabilities and namespaces can be used with or without containers.
by thinkmassive 8y ago
If the same compromised app is running natively then the entire system is now compromised. Capabilities and namespaces can be used with or without containers.
- auslander 8y ago1. You may have different apps, owned by different owners, running as containers on same underlying host machine. 2. Not running docker means you can lock your httpd by chroot, FreeBSD jail or OpenBSD pledge.