3 ms·
Why would a VM have an advantage over docker here? You think the Windows WeChat client is designed to escape from docker if it ever finds itself inside one whil
by Tenoke 7y ago
Why would a VM have an advantage over docker here? You think the Windows WeChat client is designed to escape from docker if it ever finds itself inside one while running on linux?
- Nullabillity 7y agoEven if you ignore that Docker is not a good security boundary.. DoChat bypasses a lot of the protections that Docker does apply. In particular: - --privileged basically gives it the same capabilities as root - Forwarding the X socket means that it has full access to your desktop, including keylogging and so on - IPC isolation is disabled, so it has full access to any shared memory exposed on the host (again, with root privileges)