3 ms·

> security problems if you choose to run under k8s I'm here wondering, what security problems could this have? https://docs.ops.city/ops/k8s https://docs.ops.c

• Twirrim 3y ago
  pure speculation: I imagine it's just "Well, now there will be Linux involved" where previously you'd just be relying on Nanos.
• eyberg 3y ago
  I can speak to this. Containers, and by extension k8s, break a well known security boundary that has existed for a very long time - whether you are using a real (hardware) server or a virtual machine on the cloud if you pop that instance/server generally speaking you only have access to that server. Yeh, you might find a db config with connection details if you landed on say a web app host but in general you still have to work to start popping the next N servers. That's not the case when you are running in k8s and the last container breakout was just announced ~1 month ago: https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv https://github.com/opencontainers/runc/security/advisories/G... . At the end of the day it is simply not a security boundary. It can solve other problems but not security ones.