3 ms·
I just deployed a WordPress container on the same host that runs everything else. Makes me a bit uncomfortable. Was thinking about running a VM just as a Docker
by mastax 5y ago
I just deployed a WordPress container on the same host that runs everything else. Makes me a bit uncomfortable. Was thinking about running a VM just as a Docker Swarm worker node, but this post reminded me that these virtualization runtimes exist. Looks like there's a drop-in containerd replacement using firecracker. Kata containers look a bit better supported, though?
Or am I too paranoid about container escapes?
- throwaway984393 5y agoWhat are you worried about them doing? If they take over the app inside the container, they can access your database and seed malware in your users' browsers.
- staticassertion 5y agoI don't think you can be too paranoid about container escapes. We actually don't consider containers to be a reliable security boundary - we take it where we can, but if we need real isolation it has to be combined with another approach.