4 ms·
The issue with container security is that the linux kernel boundary is porous and probably not possible to secure in depth.
by foobiekr 4y ago
The issue with container security is that the linux kernel boundary is porous and probably not possible to secure in depth.
- freedomben 4y agoI don't necessarily disagree with "the linux kernel boundary is porous and probably not possible to secure in depth", but IIUC the hypervisor is part of the kernel too, so wouldn't it have the same problem? The win would be in the attack surface area. For hypervisors there's a good layer of abstraction to pivot over, whereas with containers it's a much thinner wall.
- tptacek 4y agoKVM is a much smaller chunk of the kernel than the entire system call interface, along with every exposed device and its suite of ioctls.
- foobiekr 4y agoKVM presents a very narrow, well understood surface that is much much less of a moving target and changes at a much slower rate. Qemu has traditionally been a problem which is why Amazon and google have moved away from it. The container kernel surface is just insane by comparison.