4 ms·
Docker containers do not yet offer the same security or “bring your own kernel” flexibility of full VMs, such as access to a CPU’s VT-x features.
by buildbuildbuild 7y ago
Docker containers do not yet offer the same security or “bring your own kernel” flexibility of full VMs, such as access to a CPU’s VT-x features.
- Bombthecat 7y agoYou think they will, one day?
- mav3rick 7y agoYou can tighten containers but at the end of the day they are running as native processes on the same kernel. Any vulnerability and game is over. VM offers an easier (maybe heavy) mental model of security. Between guests and between guest and host.
- koffiezet 7y agoA jail breakout, it being from a process namespace or a VM, is always a security-risk - whatever it's breaking out of. Both are sensitive to this. VM's are maybe a bit more mature and handle some stuff on hardware - but given the recent Intel oops thingies - I wouldn't rely on that too much... "Containers are less secure" is just FUD. That VM's or containers alike are running on the same CPU is currently a much more real threat.
- dharmab 7y agoDocker- probably not. Other runtimes like Kata and Firecracker? Probably.
- koffiezet 7y agoThe docker daemon itself - sure, but on OS/kernel level, they're doing exactly the same thing, where docker is probably the more scrutinized implementation out-there...