4 ms·
> Why not have 1 daemon, rather than 1 daemon per container? Having a daemon per container has this little advantage that if something manages to bring down on
by WesolyKubeczek 3y ago
> Why not have 1 daemon, rather than 1 daemon per container?
Having a daemon per container has this little advantage that if something manages to bring down one of the daemons, it won't bring down the whole shebang.
- amelius 3y agoAlso side-channel attacks. E.g. if one user downloads a container, and then for another user it is already in the cache, this gives the other user information about the first user.
- Fire-Dragon-DoL 3y agoIsn't this pointless, since if the other user has access to docker, they basically have root access to the machine?
- amelius 3y agoI don't think users need to have root access to use Docker.
- Fire-Dragon-DoL 3y agoNo, but unless they run in rootless mode, they can mount any directory and write on it as root
- seba_dos1 3y agoThey don't, but if you have given them access to Docker then it's just as if you had given them access to root.