4 ms·

We should call this newly invented and wholly original concept a "container". The software gets "contained". It just might work. /s

• eecc 6y ago
  You mean cgroups, or zones don’t you? Docker (was, last time I heard) a security disaster, not generating robust layer hashes, lacking user isolation, and plenty just running as root...
  • giantrobot 6y ago
    There's more to containers on Linux than just Docker.
    • ampdepolymerase 6y ago
      To be fair you need to go to the hypervisor level (like Firecracker) to get any decent level of sandboxing.
• progval 6y ago
  For security by isolation, you don't even need containers. Just run each application as its own user. This is already done by most (all?) daemons packaged in Debian that don't need to be root.