4 ms·
“devices: - /dev/kvm” Well yeah, sure, you’re running a qemu vm in a container, that’s not exactly the same thing here. No one will (should) ever exp
by reactordev 3y ago
“devices:
- /dev/kvm”
Well yeah, sure, you’re running a qemu vm in a container, that’s not exactly the same thing here.
No one will (should) ever expose /dev/kvm to containers in production.
- tkubacki 3y agoIsn’t that just easy way to run Windows on my laptop ? Docker is not about security, but about lazyness.
- teaearlgraycold 3y agoSome people see the word “containerization” and confuse it with “sandboxing”. It’s about defining your requirements on a filesystem level. Not security.
- Timber-6539 3y agoDocker gives you plenty of tools to sandbox & isolate your applications. Just like any other consumer-facing product you will have to roll your own security policy.
- vbezhenar 3y agoYou can use qemu for pure userspace emulation, without passing /dev/kvm. It'll be slow. Probably unusable for Windows. However I used this kind of emulation to build images with qemu from arm host and it worked OK, like few minutes to boot from Linux image, install some packages, run some commands and shutdown. Docker is actually great for that kind of applications, because you can run it everywhere: Mac, Windows with one single-line. The only problem is that it's not very convenient to use docker images just as file containers, but it works.
- NexRebular 3y agoDocker is actually not that great because you can't run it everywhere. BSD and illumos have no native docker support for example.
- k8svet 3y agoDocker is literally doing nothing there but getting you a qemu binary. There are countless better, more efficient ways to do that. Namely nix. If "running a VM" is somehow simpler with docker, you should really think about what Docker is supposedly doing for you.