5 ms·
This may be pendantry but containers aren't sandboxes, they are namespaces. It is pid remapping etc.. and any other features that even approximate a sandbox ar
by nyrikki 3y ago
This may be pendantry but containers aren't sandboxes, they are namespaces.
It is pid remapping etc.. and any other features that even approximate a sandbox are from secomp, apparmor, /proc masking etc...
Namespaces not being jails or sandboxes is an important concept.
- mgaunard 3y agoBy running the process under a different filesystem namespace than "normal" processes, you're effectively sandboxing it.
- nyrikki 3y agoNot when I can read the root filesytem if mknod privilege isn't dropped, update firmware on the EFI partition, load kernel modules in the host namespace etc.... But it is really about the order namespaces start with almost no isolation and you add whatever you want. Sandboxes and Jails tend to start more restricted by default. As an example here is an older step by step example of the above. Note how disabling privileged containers at the docker server layer is still not possible as they decided user namespaces were their solution. https://stackoverflow.com/questions/36425230/privileged-containers-and-capabilities/44100971#44100971 https://stackoverflow.com/questions/36425230/privileged-cont...
- kiitos 3y agoThe line is fuzzy. Containers are processes, but sandboxing requires more than just FS/chroot isolation.
- nyrikki 3y agoYes it is fuzzy, the point being is that most people assume sandboxes are some form of default deny. With containers, there is a responsibility for both the instantiation and the container image to ensure that isolation happens. That is why I hesitate to consider them equal as the responsibilities are different.