3 ms·

Docker was not made for security, and this is explicitly documented in its manual. Also, you don't need VM, just playing with namespaces, chroots and syscall f

Docker was not made for security, and this is explicitly documented in its manual. Also, you don't need VM, just playing with namespaces, chroots and syscall filters should be enough. VMs are very ineffective and complicated.

pdpi 7y ago
Funny you say the docker is not for security (it’s there in the manual) but then suggest chroot of all things — that is just as well documented as not being meant for security!
- eeZah7Ux 7y ago
  On the contrary, docker increases the attack surface.
  - pdpi 7y ago
    The point is that neither tool has a security focus, any security characteristics they might have are incidental and not at all guaranteed, and so neither should be used for that purpose.