3 ms·
This is a really interesting read, thanks for the write up. I had no idea they were running these customer services on k8s, given that it is untrusted code and
by karakanb 3y ago
This is a really interesting read, thanks for the write up. I had no idea they were running these customer services on k8s, given that it is untrusted code and containers are not the best isolation layer. Are there any pointers on how Render approached running untrusted code in k8s?
- anurag 3y agoContainers are just one isolation layer of many we've built into our systems over the years. A topic for another post, and happy to chat if this is something you're working on.
- throwkwknskkc 3y ago[dead]
- cyrnel 3y agoWith the right amount of hardening, containers can provide a relatively secure sandbox. It's certainly not built for that which leads to natural weaknesses, but in my experience auditors seem pretty happy with the controls present in OpenShift (page 79): https://www.redhat.com/en/resources/openshift-security-guide-ebook https://www.redhat.com/en/resources/openshift-security-guide...