7 ms·
I'd worry more about the security of the control plane itself rather than the shared kernel. For instance Heroku has been doing shared hosting forever, but they
by cpuguy83 6y ago
I'd worry more about the security of the control plane itself rather than the shared kernel.
For instance Heroku has been doing shared hosting forever, but they are not using a generic control plane.
Even with a vm based runtime bugs in the control plane, from the scheduler up to and including the container bootstrapper, will yield any protection here useless.
- benmmurphy 6y agoI would be definitely wary of smaller cloud providers when it comes to this. I know of one that I'm pretty sure at some point was vulnerable to their whole DC being hijacked if someone was able to escape from a container. It would be interesting to know with the big providers whether this was ever a problem or if they had solved this issue from day one.