3 ms·

Diving into /proc/pid/mem

• xyst 6y ago
  Interesting write up, however this brings up another question. If the use of a shared kernel amongst containers is a security blunder, why isn't this natively part of the container engine?
  • lnsp 6y ago
    It mostly comes down to security vs performance. If you have a fully trusted workload, you may decide not to use sandboxing, since using solutions like gVisor often leads to performance issues on unoptimized workloads. For most use cases runc is probably a better choice (and can be reasonably secured, of course not in the same way).
  • cpuguy83 6y ago
    I'd worry more about the security of the control plane itself rather than the shared kernel. For instance Heroku has been doing shared hosting forever, but they are not using a generic control plane. Even with a vm based runtime bugs in the control plane, from the scheduler up to and including the container bootstrapper, will yield any protection here useless.
    • benmmurphy 6y ago
      I would be definitely wary of smaller cloud providers when it comes to this. I know of one that I'm pretty sure at some point was vulnerable to their whole DC being hijacked if someone was able to escape from a container. It would be interesting to know with the big providers whether this was ever a problem or if they had solved this issue from day one.