3 ms·
The generic issue seems to be that stuff like containers can be escaped with pretty much any privilege escalation exploit ... and such exploits are reasonably c
by upofadown 7y ago
The generic issue seems to be that stuff like containers can be escaped with pretty much any privilege escalation exploit ... and such exploits are reasonably common in the world of Linux.
- nunchuckninja 7y agoSo either take perf hit or don't expect isolation at all?
- dilyevsky 7y agoFor completely untrusted workloads basically - yeah. For semi-trusted, there’s lots of tech that provides reasonable, lightweight isolation. There’s no reason why hardware vendors cant ship products that are both virtualizable with high performance and secure, so that may still come.
- aritmo 7y agoBut if the container is unprivileged?