2 ms·
Recently, a certain unmentionable trend in Linux system software makes me really want to try FreeBSD again. What’s the state of the art for unprivileged contai
by gorgoiler 6y ago
Recently, a certain unmentionable trend in Linux system software makes me really want to try FreeBSD again.
What’s the state of the art for unprivileged containers? I’m very keen on containers that look very similar to the host OS as they make excellent environments for teaching pupils about the OS, especially if the container host can fake them into being “root” in their container.
- loeg 6y agoPart of the security premise of FreeBSD Jails is that jailed root cannot escape. So, jails are a lighter-weight container which satisfies that need. They can (and often do) look very similar to the host OS. I think the gold standard here is hypervisors, and if you want to go that route, Bhyve is satisfactory for many workloads. But jails should be somewhat lighter overhead.