3 ms·
It wasn't clear to me how using user namespaces helped prevent the CVEs. Docker is already using them and it didn't protect them. Did I miss something in the de
by zimbatm 6y ago
It wasn't clear to me how using user namespaces helped prevent the CVEs. Docker is already using them and it didn't protect them. Did I miss something in the design that's different than Docker?
- sargun 6y agoThe trouble is that Docker does not enable user namespaces by default, and thus resulting in these CVEs. A lot of integrations (like the examples of secrets, and sidecars) do not work properly when used in conjunction with user namespaces, and tend to require modification. We did the work to make this work, and created a model (injected processes into the container) in order to create this clear boundary layer. Many people use Docker with Kubernetes. Unfortunately, the Kubernetes Kubelet does not work with Docker and user namespaces (https://github.com/kubernetes/enhancements/issues/127 https://github.com/kubernetes/enhancements/issues/127). There is still work being done in this area by folks like Kinvolk.