3 ms·
LXD uses privileged containers, though - this exposes a lot more attack surface, since uid 0 inside the container equals uid 0 outside.
by lima 5y ago
LXD uses privileged containers, though - this exposes a lot more attack surface, since uid 0 inside the container equals uid 0 outside.
- _joel 5y agoIt can do both. https://linuxcontainers.org/lxc/security/ https://linuxcontainers.org/lxc/security/
- ylk 5y agoThat’s not true: > By default containers are unprivileged […] https://linuxcontainers.org/lxd/docs/master/security/#container-security https://linuxcontainers.org/lxd/docs/master/security/#contai... As for LXC: > LXC containers can be of two kinds: > - Privileged containers > - Unprivileged containers > […] > The latter has been introduced back in LXC 1.0 (February 2014) […] https://linuxcontainers.org/lxc/security/ https://linuxcontainers.org/lxc/security/
- pritambaral 5y agoI have always used it for unprivileged containers, and I remember using it as such in 2016. IIRC both podman and rootless docker are much more recent.