5 ms·

Thanks for the detailed explanation, this is very useful! This is a pretty open ended question, but what approach would you choose in order to get the most secu

by lifty 5y ago

Thanks for the detailed explanation, this is very useful! This is a pretty open ended question, but what approach would you choose in order to get the most security for the buck, for a piece of software that runs containers for non-technical users, where the apps come from 3rd party developers? Containerd and runc expose some of these security levers but it's a bit daunting to build the right approach without burdening the user too much.

staticassertion 5y ago
If you're running 3rd party code that more or less moves you into the namespace/container world or the LSM world. You aren't going to want to maintain a seccomp filter for 3rd party software. It's going to really depend on what you're going for, but probably something along the lines of "docker + best practices" is the most bang for your buck solution.
- lifty 5y ago
  Ok, that's inline with what I expected. I was also thinking of mandating that developers embed some kind of manifest with the app which states what resources it consumes (public ports, Internet connectivity to specific hosts etc) so that the system could enforce some boundaries around that, perhaps using eBPF. For the syscall fencing the Landlock project might be of use. Appreciate the advice.
- littlestymaar 5y ago
  I've heard multiple times that docker wasn't suited for security isolation as it wasn't designed for it (even though the underlying mechanisms can be used for that purpose). Had something changed recently on that front?
  - staticassertion 5y ago
    It's just a matter of your threat model.