3 ms·
I’m not suggesting it’s sane particularly if your threat model is nation state level actors, but people use containers (chroot, docker, vms) as a security bound
by Bnshsysjab 7y ago
I’m not suggesting it’s sane particularly if your threat model is nation state level actors, but people use containers (chroot, docker, vms) as a security boundary all the time.
- michaelmrose 7y agoNeither chroot or docker is a worthwhile security boundary. People that act as if it is risk appearing incompetent when they get compromised.
- Bnshsysjab 7y agoI’d argue that anything but bare metal is not a good compromise, but I’m not balancing the books of a large company. People care about docker escapes so they’re getting more difficult, at least. Edit: Plus, I’d rather $app_i_dont_fully_trust be sitting in a container rather than on my host. And no, not running apps i don’t fully trust is not something which is at all viable for me.