2 ms·
You're telling those namespace / cgroup features have nothing to do with security? Not in any way, shape, or form? I'm a little skeptical.
by icedchai 3y ago
You're telling those namespace / cgroup features have nothing to do with security? Not in any way, shape, or form? I'm a little skeptical.
- jmillikin 3y agoNamespaces and cgroups provide resource accounting and some limited isolation between trusted workloads. They're not considered a sandbox or security boundary because the processes have full access to the Linux kernel APIs, which are not well-hardened. To provide a security boundary between Linux processes, it's currently considered best practice to use something like Firecracker or gVisor.
- icedchai 3y agoI agree containers are more for ease of deployment, not security. But security is about shades of gray… limited isolation is one of those.