4 ms·

Actually lxc is fairly mature and a more "Linux native" sandboxing feature. But docker certainly was/is more popular.

ajross 8y ago
I know. And the linked project is an effort in that direction too. The point was that a knee jerk "sandboxing in linux is hard" argument is just silly on its face. Because Docker. Just go read any of the bajillion tutorials and testimonials about how to get your process to run in a sandbox.
- hedora 8y ago
  Are any of the linux sandboxes considered secure yet? Last I checked, they weren’t suitable for multi-tenant machines or for running untrusted code.
  - cpuguy83 8y ago
    Fundamentally they share a kernel with the host. This has its own implications. Beyond that it is very difficult to get things right, and there's definitely some information leakage (e.g. see the output of `mount` in a docker container... not a docker specific problem). The main issue is, having a VM layer is always going to be "more secure" (because it's another security boundary) than not having a VM layer. Of course VM's have their own issues. So if you have a need to run multi-tenant/untrusted workloads it's kind of a CYA situation where if you don't use this extra security boundary and there is a problem sometime down the line then you'll have to answer questions like "why didn't you do ..." The reality is you can do a lot to lock things down with seccomp+selinux/apparmor.
  - ajross 8y ago
    Secure for what? I mean, sandboxing is more or less inherently a security technique. An app running in a Docker (or whatever) container is less exposed than one running on a big shared host. Is it as firm an isolation as you get from a proper virtual machine layer? No. But then, as we've discovered over the past year the hardware itself can have bugs that poke holes in that protection. No free lunch. But yeah, Linux's suite of "container" tools are basically as secure as any other OS's "containers", no matter what spin you're reading elsewhere.

I know. And the linked project is an effort in that direction too. The point was that a knee jerk "sandboxing in linux is hard" argument is just silly on its face. Because Docker. Just go read any of the bajillion tutorials and testimonials about how to get your process to run in a sandbox.

hedora 8y ago
Are any of the linux sandboxes considered secure yet? Last I checked, they weren’t suitable for multi-tenant machines or for running untrusted code.
- cpuguy83 8y ago
  Fundamentally they share a kernel with the host. This has its own implications. Beyond that it is very difficult to get things right, and there's definitely some information leakage (e.g. see the output of `mount` in a docker container... not a docker specific problem). The main issue is, having a VM layer is always going to be "more secure" (because it's another security boundary) than not having a VM layer. Of course VM's have their own issues. So if you have a need to run multi-tenant/untrusted workloads it's kind of a CYA situation where if you don't use this extra security boundary and there is a problem sometime down the line then you'll have to answer questions like "why didn't you do ..." The reality is you can do a lot to lock things down with seccomp+selinux/apparmor.
- ajross 8y ago
  Secure for what? I mean, sandboxing is more or less inherently a security technique. An app running in a Docker (or whatever) container is less exposed than one running on a big shared host. Is it as firm an isolation as you get from a proper virtual machine layer? No. But then, as we've discovered over the past year the hardware itself can have bugs that poke holes in that protection. No free lunch. But yeah, Linux's suite of "container" tools are basically as secure as any other OS's "containers", no matter what spin you're reading elsewhere.