3 ms·
here is a secret: there is no such thing as a container. it’s an abstraction we made up and containers rely on kernel features. if you use those features correc
by rantwasp 6y ago
here is a secret: there is no such thing as a container. it’s an abstraction we made up and containers rely on kernel features. if you use those features correctly it’s as secure as it gets - chances are that if you’re going to roll your own you’ll miss some things.
- mehrdadn 6y agoThat doesn't answer my question at all. I'm well aware containers aren't a "real thing". My entire question was about the "if" part that you didn't address. Is anything missed here? is my question.
- rantwasp 6y agoin theory, it’s a secure as the kernel if your code does the right thing. that being said, the attack surface is wider than say if you would run it in a VM or its own physical machine
- mehrdadn 6y agoWell obviously "if your code does the right thing" then it's going to be secure rather than insecure... by definition. That's again a pretty unhelpful tautology. I'm asking about the code in the webpage, not code I'm writing personally. I'm saying let's assume it has error-handling added to it. That's it. I am not writing any code otherwise. Is that code doing "the right thing"? Or are there more things it needs to be doing?