12 ms·

There are serious attempts at secure container runtimes (see gVisor) and runtimes that run container images in a real VM (see Firecracker). This meme that cont

There are serious attempts at secure container runtimes (see gVisor) and runtimes that run container images in a real VM (see Firecracker). This meme that containers are inherently insecure just because Docker doesn't attempt to be a security product needs to die. Docker hasn't been the only player in the container runtime space for a long time.

Thaxll 4y ago
Insecure is a very strong word, world has been running on Docker for sometime and it works fine and is not as insecure has you seem to think.
- cmeacham98 4y ago
  I agree that Docker actually has a relatively good track record, but it is true that Docker will never be on the same level as a VM hypervisor that was designed from the ground up to be a security barrier. Thus, when people bring up "Docker is insecure" I try not to get down in the weeds arguing about the specifics, and instead point out alternative projects that are designed with security in mind. I find it's a much stronger counterargument.
- ClumsyPilot 4y ago
  The world does not rely on docker for security at all, cloud providers put each tenant of container runtimes behind an additional barrier, like a VM. Secure runtimes are a superior solution to virtualisation and separate kernels. There are only two secure runtimes in common use - for javascriot and webassembly. The point about hardware support is very unfair - if you invest the same level of effort and hardware support into webassembly, you can also i prove its performance. Thats like compaining that electric cars suck because there are no chargers - its just infra.
erk__ 4y ago
I think that security has always been a goal of FreeBSD jails and I believe they are a bit more hardened than docker
- vermaden 4y ago
  Docker only uses namespaces and cgoups. Docker does not provide and security or isolation. To have security and isolation with Docker you must use something external like SELinux or AppArmor. Hope that helps. Regards.
  - xvector 4y ago
    Docker also uses seccomp.
  - rapidlua 4y ago
    > Docker only uses namespaces and cgroups. How is that not isolation?
    - kaba0 4y ago
      The docker daemon has basically root over your system, so any escape can end very badly.

Thaxll 4y ago

Insecure is a very strong word, world has been running on Docker for sometime and it works fine and is not as insecure has you seem to think.

cmeacham98 4y ago
I agree that Docker actually has a relatively good track record, but it is true that Docker will never be on the same level as a VM hypervisor that was designed from the ground up to be a security barrier. Thus, when people bring up "Docker is insecure" I try not to get down in the weeds arguing about the specifics, and instead point out alternative projects that are designed with security in mind. I find it's a much stronger counterargument.
ClumsyPilot 4y ago
The world does not rely on docker for security at all, cloud providers put each tenant of container runtimes behind an additional barrier, like a VM. Secure runtimes are a superior solution to virtualisation and separate kernels. There are only two secure runtimes in common use - for javascriot and webassembly. The point about hardware support is very unfair - if you invest the same level of effort and hardware support into webassembly, you can also i prove its performance. Thats like compaining that electric cars suck because there are no chargers - its just infra.

erk__ 4y ago

I think that security has always been a goal of FreeBSD jails and I believe they are a bit more hardened than docker

vermaden 4y ago
Docker only uses namespaces and cgoups. Docker does not provide and security or isolation. To have security and isolation with Docker you must use something external like SELinux or AppArmor. Hope that helps. Regards.
- xvector 4y ago
  Docker also uses seccomp.
- rapidlua 4y ago
  > Docker only uses namespaces and cgroups. How is that not isolation?
  - kaba0 4y ago
    The docker daemon has basically root over your system, so any escape can end very badly.