3 ms·
There is no technical panacea, but containers are a useful abstraction. Containers bring back the original intent of the unix process/user security model, allow
by GauntletWizard 7y ago
There is no technical panacea, but containers are a useful abstraction. Containers bring back the original intent of the unix process/user security model, allowing you to scope each process to have it's own 'private' filesystem to get around the broken way executables are built, packaged, and linked.
This doesn't save you if you do dumb things, like have open ports that allow administrative access that are exposed to the rest of your (potentially malicious) system. They do force you to think about some of the questions, though, like "Where is my data stored and how do other tools interact with it?"
Most of the problems that people complain containers don't solve are ones that are open ended, and have no definite solution.
- taeric 7y agocontainers are a great tool for corporate servers. For end user machines, it is a tougher sell.
- GauntletWizard 7y agoWhat do you think of the permissions associated with Android apps? Each developer gets a separate and cordoned user account on your phone. They only have access to private storage unless they request it through special APIs. Android apps are run in containers, for some broad sense of the word. That's how it should be. Every app I run should be run with a simply configured set of permissions, and "per app" or "as user" makes sense, even in the desktop space. That's what snap originally tried to do (but failed at, and have now broken)
- taeric 7y agoIsn't that where I said it can get silly? I don't want developers having an account on my phone. I just want to process some data on my phone. Consider that on my phone, I am limited to accessing my data for most apps through the apps. On my computer, I typically know where the data is stored.