4 ms·
There's a couple that spring to mind - Consistent packaging/execution environment. containers are delivered and executed in a standard way regardless of target
by raesene9 5y ago
There's a couple that spring to mind
- Consistent packaging/execution environment. containers are delivered and executed in a standard way regardless of target env.
- A level of sandboxing from the underlying host. Things like automatically applied Linux namespaces and dropped capabilities if you use Docker/runc, and then more sandboxing automatically applied if you use things like gVsior or firecracker.
- megous 5y ago1) Is not needed if your app has no dependencies (otherwise it would not work in an empty "container") 2) Sandboxing can be done using a systemd service configuration to a large extent.
- raesene9 5y ago1) I was more thinking of the delivery mechanism via centralized registries (i.e. Docker pull works for anything) 2) Sure in theory, you can totally replicate docker's sandboxing with Linux security principles, however containerized deployment gives you an easy to use sensible starting point :)