3 ms·
> They claim that "standard containers" cannot run a full OS. ... this works just fine with rootless podman and, more recently, rootless docker. > Anyone who w
by pritambaral 5y ago
> They claim that "standard containers" cannot run a full OS. ... this works just fine with rootless podman and, more recently, rootless docker.
> Anyone who wants unprivileged system containers might want to look into rootless docker or podman rather than this.
Perhaps I'm missing something, but I have been running full OS userlands using "standard containers" in production for years, via LXD[1].
[1]: https://linuxcontainers.org/ https://linuxcontainers.org/
- lima 5y agoLXD uses privileged containers, though - this exposes a lot more attack surface, since uid 0 inside the container equals uid 0 outside.
- _joel 5y agoIt can do both. https://linuxcontainers.org/lxc/security/ https://linuxcontainers.org/lxc/security/
- ylk 5y agoThat’s not true: > By default containers are unprivileged […] https://linuxcontainers.org/lxd/docs/master/security/#container-security https://linuxcontainers.org/lxd/docs/master/security/#contai... As for LXC: > LXC containers can be of two kinds: > - Privileged containers > - Unprivileged containers > […] > The latter has been introduced back in LXC 1.0 (February 2014) […] https://linuxcontainers.org/lxc/security/ https://linuxcontainers.org/lxc/security/
- pritambaral 5y agoI have always used it for unprivileged containers, and I remember using it as such in 2016. IIRC both podman and rootless docker are much more recent.
- ctalledo 5y agoLXD is great, but one nice feature of Sysbox is that it's an OCI-based runtime, and therefore integrates with Docker, K8s, etc. In a way, Sysbox turns Docker containers or Kubernetes pods into LXD-like containers, although there are differences.