3 ms·
The point is that containers are actually just running PIDS, if you were to escape the process, you would have access to the host without security measures like
by markandrewj 6y ago
The point is that containers are actually just running PIDS, if you were to escape the process, you would have access to the host without security measures like selinux. You can also use selinux stop things like interprocess communication.
Something I notice in regards to selinux, is many people don't understand that you are not just applying context to files, but also PID's. You can see the context of a PID by doing 'ps -eZ', similar to how you would with files. This allows you to create a finer degree of process seperation.
You are right though, RedHat has been doing this with OpenShift since 2011, and it is a major part of their security model. RedHat's current push is the deployment of rootless containers, which addresses similar concerncs.