3 ms·
The line is fuzzy. Containers are processes, but sandboxing requires more than just FS/chroot isolation.
by kiitos 3y ago
The line is fuzzy. Containers are processes, but sandboxing requires more than just FS/chroot isolation.
- nyrikki 3y agoYes it is fuzzy, the point being is that most people assume sandboxes are some form of default deny. With containers, there is a responsibility for both the instantiation and the container image to ensure that isolation happens. That is why I hesitate to consider them equal as the responsibilities are different.