3 ms·
First of all - the Namespaces and Cgroups on Linux are not about security. They are about features. FreeBSD Jails provide both secure isolation from the host a
by vermaden 3y ago
First of all - the Namespaces and Cgroups on Linux are not about security. They are about features.
FreeBSD Jails provide both secure isolation from the host and also provide the separated network namespace and resources with rctl(8) when needed.
To have Linux containers separated and secured you need additional layer for that - like SELinux or AppArmor. Only then Docker/Podman/other/... Linux containers are isolated and secure.
Regards.
- icedchai 3y agoYou're telling those namespace / cgroup features have nothing to do with security? Not in any way, shape, or form? I'm a little skeptical.
- jmillikin 3y agoNamespaces and cgroups provide resource accounting and some limited isolation between trusted workloads. They're not considered a sandbox or security boundary because the processes have full access to the Linux kernel APIs, which are not well-hardened. To provide a security boundary between Linux processes, it's currently considered best practice to use something like Firecracker or gVisor.
- icedchai 3y agoI agree containers are more for ease of deployment, not security. But security is about shades of gray… limited isolation is one of those.
- user6723 3y agoUnderrated post.