3 ms·

> We've had exploits specifically targeting the namespaces API already Well, isn't that what happens when you put a shield into place? Someone tries to break i

• tptacek 4y ago
  Because the broad kernel attack surface is huge, and the shield has to reliably protect all of it, or all you've done is create a jungle gym for vulnerability researchers. The win with virtualization is that it drastically scopes down the amount of kernel code exposed to untrusted code.