4 ms·
If you're running 3rd party code that more or less moves you into the namespace/container world or the LSM world. You aren't going to want to maintain a seccomp
by staticassertion 5y ago
If you're running 3rd party code that more or less moves you into the namespace/container world or the LSM world. You aren't going to want to maintain a seccomp filter for 3rd party software.
It's going to really depend on what you're going for, but probably something along the lines of "docker + best practices" is the most bang for your buck solution.
- lifty 5y agoOk, that's inline with what I expected. I was also thinking of mandating that developers embed some kind of manifest with the app which states what resources it consumes (public ports, Internet connectivity to specific hosts etc) so that the system could enforce some boundaries around that, perhaps using eBPF. For the syscall fencing the Landlock project might be of use. Appreciate the advice.
- littlestymaar 5y agoI've heard multiple times that docker wasn't suited for security isolation as it wasn't designed for it (even though the underlying mechanisms can be used for that purpose). Had something changed recently on that front?
- staticassertion 5y agoIt's just a matter of your threat model.