3 ms·
""Improved security" is also a red herring. You can't make something more secure by adding an additional layer of abstraction." I have not used docker. Howeve
by rsync 8y ago
""Improved security" is also a red herring. You can't make something more secure by adding an additional layer of abstraction."
I have not used docker. However, I have been putting things in containers with FreeBSD 'jail' since 2001 ...
If I jail my httpd and there is a vuln in the httpd, the attacker gets the jail (and the httpd, etc.) but not the underlying system.
That's a huge win, in my mind - is that not how it works in dockerland ?
- weberc2 8y agoLast I checked, Docker containers are not hard to break out of unless you go to extra lengths (SELinux, AppArmor, etc--not entirely sure; I'm not an expert). Most people use Docker as a way to avoid their programs accessing the wrong version of a shared dependency or similar. I believe there may be other container runtimes with stronger guarantees or better defaults, some of which are even suitable for running untrusted code (or so they advertise).
- rsync 8y agoThanks - good to know. jail is pretty tremendous - a real win in many areas.