4 ms·
I hear conflicting voices about this. On the one hand, the statement "containers are not made for security" is made often. On the other hand, a lot of work se
by TekMol 4y ago
I hear conflicting voices about this.
On the one hand, the statement "containers are not made for security" is made often.
On the other hand, a lot of work seems to go into the issue of "container escapes": https://www.google.com/search?q=%22container%20escape%22 https://www.google.com/search?q=%22container%20escape%22
And going through these results, all of these escapes seem to need privileged containers that are run with the "--privileged" flag.
Isn't that a sign that normal containers are pretty secure? Otherwise, why would all the escapes need special containers started with a flag that actively gives them permissions to access the host?
- kstenerud 4y agoOf course we all want containers to be more secure because that would give us more bang for the buck on installed iron if we have better security guarantees that shift the risk assessment for deployment. But I doubt that containers will ever be as secure as virtualization, nor will virtualization be as secure as a separate machine. In the end it comes down to your risk appetite.