3 ms·
Containerization is only meant for isolation (preventing accidental contamination), not security (thwarting malicious code). If you are looking for security, vi
by kstenerud 4y ago
Containerization is only meant for isolation (preventing accidental contamination), not security (thwarting malicious code). If you are looking for security, virtualization is better (although there are virtualization escape exploits in the wild), and isolated bare metal is best.
- TekMol 4y agoI hear conflicting voices about this. On the one hand, the statement "containers are not made for security" is made often. On the other hand, a lot of work seems to go into the issue of "container escapes": https://www.google.com/search?q=%22container%20escape%22 https://www.google.com/search?q=%22container%20escape%22 And going through these results, all of these escapes seem to need privileged containers that are run with the "--privileged" flag. Isn't that a sign that normal containers are pretty secure? Otherwise, why would all the escapes need special containers started with a flag that actively gives them permissions to access the host?
- kstenerud 4y agoOf course we all want containers to be more secure because that would give us more bang for the buck on installed iron if we have better security guarantees that shift the risk assessment for deployment. But I doubt that containers will ever be as secure as virtualization, nor will virtualization be as secure as a separate machine. In the end it comes down to your risk appetite.