5 ms·
One side has a huge footprint to secure (software-system), because it's every way software could ever need to interact with a local system. The other can expos
by ethbr0 5y ago
One side has a huge footprint to secure (software-system), because it's every way software could ever need to interact with a local system.
The other can expose a much smaller one (container-system), because it only needs to include things one would have gone off-local-machine for (i.e. networking).
So from a security boundary, containers are basically a machine-internal firewall between programs and the host.
- throw0101a 5y ago> So from a security boundary, containers are basically a machine-internal firewall between programs and the host. Which is only useful if they actually provide security.
- ethbr0 5y agoYou're missing my point. It's effectively impossible to ever provide security at the program-system interface, due to the surface area. (I.e. the SELinux problem) The very concept of having a container (that internally simulates a system) creates fundamentally different opportunities that allow both (programs that work) and (security). Whinging about whether or not current containers do a good or bad job of it is a less interesting, short term quibble.