6 ms·

Please provide technical details of `Jails are far more secure`.

• throw0101c 3y ago
  Multiple CVEs for escaping? E.g.: * https://blog.aquasec.com/cve-2022-0185-linux-kernel-container-escape-in-kubernetes https://blog.aquasec.com/cve-2022-0185-linux-kernel-containe... * https://securitylabs.datadoghq.com/articles/dirty-pipe-container-escape-poc/ https://securitylabs.datadoghq.com/articles/dirty-pipe-conta... * https://snyk.io/learn/docker-security/top-5-vulnerabilities/ https://snyk.io/learn/docker-security/top-5-vulnerabilities/ * https://www.container-security.site/attackers/container_breakout_vulnerabilities.html https://www.container-security.site/attackers/container_brea... The only escaping of jails that I've heard of in the last ~20 years is one not in the jails code, but tunnelling out through devfs: * https://www.freebsd.org/security/advisories/FreeBSD-SA-14:07.devfs.asc https://www.freebsd.org/security/advisories/FreeBSD-SA-14:07...
  • betaby 3y ago
    No? Because many of them Docker specific. Neither I mentioned Docker anywhere, not Docker is a good example of software with a good security record. Another link lumps together k8s, runc and so on. I specifically mentioned systemd-nspaw in the beginning as contender to jails, not other solutions.
  • tptacek 3y ago
    Misleading: the most important vulnerabilities that break shared-kernel isolation systems like Jails, Zones, and containers are kernel LPEs, and they aren’t reported as “escapes”.