3 ms·

This doesn't work like that. Containers (like docker, LXC and other based on cgroups etc) are isolated by the kernel but they share the same kernel. This means

This doesn't work like that. Containers (like docker, LXC and other based on cgroups etc) are isolated by the kernel but they share the same kernel. This means that kernel exploit will make all those containers insecure by your definition. If you go further and try to embed containers in hardware virtualization layer (so basically mini VMs) you still don't have any guarantees because from time to time new exploit emerges that allows to break out from guest OS to hypervisor. Then you have hardware layer and exploits based on speculative execution (Spectre, Meltdown and friends). Truly secure container doesn't exist. You would need some kind of mathematical proof for whole hardware stack and all communications between different hardware subsystems + whole kernel + container runtime.

zackmorris 7y ago
Hmmm that doesn't inspire a lot of confidence. I'd maybe be fine with a VM then, if containers fundamentally can't be made secure. Short of a mathematical "proof" of security, the best I could come up with was to leave containers open for the hackers of the world to exploit. If a container survives, that's a fairly strong guarantee that it can't be escaped (for now). What I am getting at is: if we know that hackers can break out of containers, then how are we ok with shared hosting running in containers? Once one gets owned, it's trivial to break into the others. Edit: this might be a way to force maintainers to fix kernel exploits as well.