3 ms·

Just this week there was a story[0] with a subthread about how Docker requires you to mount a volume, so it is better than launching shell scripts directly. I k

Just this week there was a story[0] with a subthread about how Docker requires you to mount a volume, so it is better than launching shell scripts directly. I know all software has bugs, but Docker did not prioritize security and is unfit for isolation of untrusted code. I will continue to stick with VMs as my security boundary. [0] https://news.ycombinator.com/item?id=39240471 https://news.ycombinator.com/item?id=39240471

mrweasel 3y ago
Just pointing out the most VM / virtualization platforms have also had security problems where an attacker could escape the VM and access the underlying operating system.
- flaminHotSpeedo 3y ago
  The major difference is that VM's are intended to be a security boundary as a primary function, and give you tools like hardware virtualization or enforcing single tenancy for a given NUMA node to reduce the attack surface.
- tptacek 3y ago
  KVM vulnerabilities are rare compared to Linux kernel LPEs, which makes sense, because KVM is a relatively small part of the Linux kernel compared to the system call and driver attack surface. Containers are great, but shared-kernel security isolation of standard Unix programs doesn't work.
hipadev23 3y ago
Maybe I’m in the minority here, but I use containers for ease of packaging and deployment, security isn’t really my expectation for the container as I also rely on VMs for that aspect. I have a handful of long-running VMs with docker engine installed, and that serves as my application platform.
- flaminHotSpeedo 3y ago
  Definitely not the minority, anyone who needs secure isolation for a container should be wrapping it in a single tenant VM
  - throwoutway 3y ago
    Firecracker has often been recommended (here on HN and elsewhere) for a VM-for container-execution model : https://github.com/firecracker-microvm/firecracker https://github.com/firecracker-microvm/firecracker
    - tptacek 3y ago
      There's also Cloud Hypervisor, which is very similar, and based off some of the same crosvm code and ideas. https://github.com/cloud-hypervisor/cloud-hypervisor https://github.com/cloud-hypervisor/cloud-hypervisor
      - westurner 3y ago
        gvisor; `runsc`: https://gvisor.dev/docs/ https://gvisor.dev/docs/ : > gVisor provides a virtualized environment in order to sandbox containers. The system interfaces normally implemented by the host kernel are moved into a distinct, per-sandbox application kernel in order to minimize the risk of a container escape exploit. gVisor does not introduce large fixed overheads however, and still retains a process-like model with respect to resource utilization. https://news.ycombinator.com/item?id=38609105 https://news.ycombinator.com/item?id=38609105 kata containers: https://github.com/kata-containers https://github.com/kata-containers : > Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs.

mrweasel 3y ago

Just pointing out the most VM / virtualization platforms have also had security problems where an attacker could escape the VM and access the underlying operating system.

flaminHotSpeedo 3y ago
The major difference is that VM's are intended to be a security boundary as a primary function, and give you tools like hardware virtualization or enforcing single tenancy for a given NUMA node to reduce the attack surface.
tptacek 3y ago
KVM vulnerabilities are rare compared to Linux kernel LPEs, which makes sense, because KVM is a relatively small part of the Linux kernel compared to the system call and driver attack surface. Containers are great, but shared-kernel security isolation of standard Unix programs doesn't work.

hipadev23 3y ago

Maybe I’m in the minority here, but I use containers for ease of packaging and deployment, security isn’t really my expectation for the container as I also rely on VMs for that aspect. I have a handful of long-running VMs with docker engine installed, and that serves as my application platform.

flaminHotSpeedo 3y ago
Definitely not the minority, anyone who needs secure isolation for a container should be wrapping it in a single tenant VM
- throwoutway 3y ago
  Firecracker has often been recommended (here on HN and elsewhere) for a VM-for container-execution model : https://github.com/firecracker-microvm/firecracker https://github.com/firecracker-microvm/firecracker
  - tptacek 3y ago
    There's also Cloud Hypervisor, which is very similar, and based off some of the same crosvm code and ideas. https://github.com/cloud-hypervisor/cloud-hypervisor https://github.com/cloud-hypervisor/cloud-hypervisor
    - westurner 3y ago
      gvisor; `runsc`: https://gvisor.dev/docs/ https://gvisor.dev/docs/ : > gVisor provides a virtualized environment in order to sandbox containers. The system interfaces normally implemented by the host kernel are moved into a distinct, per-sandbox application kernel in order to minimize the risk of a container escape exploit. gVisor does not introduce large fixed overheads however, and still retains a process-like model with respect to resource utilization. https://news.ycombinator.com/item?id=38609105 https://news.ycombinator.com/item?id=38609105 kata containers: https://github.com/kata-containers https://github.com/kata-containers : > Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs.