3 ms·
> So from a security boundary, containers are basically a machine-internal firewall between programs and the host. Which is only useful if they actually provid
by throw0101a 5y ago
> So from a security boundary, containers are basically a machine-internal firewall between programs and the host.
Which is only useful if they actually provide security.
- ethbr0 5y agoYou're missing my point. It's effectively impossible to ever provide security at the program-system interface, due to the surface area. (I.e. the SELinux problem) The very concept of having a container (that internally simulates a system) creates fundamentally different opportunities that allow both (programs that work) and (security). Whinging about whether or not current containers do a good or bad job of it is a less interesting, short term quibble.