2 ms·
Hmm... that's not good, I really prefer LXC to docker (mainly because of better security and that I use Ubuntu and debian images instead of alpine anyway)
by zibzab 5y ago
Hmm... that's not good, I really prefer LXC to docker
(mainly because of better security and that I use Ubuntu and debian images instead of alpine anyway)
- goodpoint 5y agoYou can instead use dedicated directories, virtualenvs, chroots, firejail sandboxing, systemd nspawn containers. (In increasing order of effort)
- zibzab 5y agoOnly the last one gives my the same level of security. And that one is not very user friendly.
- goodpoint 5y agoNot at all. OS packages run scripts as root during installation, and this is why you should install software only from trusted Linux distros. Sandboxing user applications is a completely orthogonal topic. You can sandbox OS-installed applications or other applications. With the same tools. Both options equally require custom configuration depending on what files and directories you want to allow or restrict access to (and syscalls and so on). Fine grained permission are a personal choice and both firejail and nspawn make it quite easy to configure.