2 ms·
Yes, if you don't need sandboxing then containers are just way easier to deal with. Although I wish they didn't use so much space.
by fwsgonzo 2y ago
Yes, if you don't need sandboxing then containers are just way easier to deal with. Although I wish they didn't use so much space.
- zekrioca 2y agoWhy couldn’t one mathematically recreate the limitations of a VM through a namespace by means of SELinux?
- kevincox 2y agoBecause the Linux kernel is incredibly complicated and shouldn't be trusted as a strong security boundary. A simple hypervisor likes has far fewer vulnerabilities so is an easier to trust boundary. They are in very different security tiers. I would summarize as containers are good for mostly trusted isolation (teams within a company, purchased software) VMs are good for general untrusted software (different tenants in a cloud provider) and separate physical hardware is for scenarios where attacks are likely (military, known malicious code). Of course use cases are very fuzzy, but I wouldn't run fully untrusted code in the same kernel as anything of value.