2 ms·
Wouldn’t you need something like gvisor and or running under a different user or podman to make this really safe? If you don’t trust the binary they can still j
by spockz 6y ago
Wouldn’t you need something like gvisor and or running under a different user or podman to make this really safe? If you don’t trust the binary they can still just break out the container.
- yjftsjthsd-h 6y agoContainer escape isn't supposed to be that easy these days, but yes there is a tradeoff between security and convenience and performance. I was objecting to the claim of overhead in using a container; if you need more protection than you can get on the same kernel then you'll pay for it in virtualization costs (granted, that's not super high anymore either).