3 ms·

They explain in a different blog post. > Now, you may wonder why profiling Rust code within Docker, an engine to run containerized applications. The main advan

They explain in a different blog post. > Now, you may wonder why profiling Rust code within Docker, an engine to run containerized applications. The main advantage of containers is that when configured properly, they provide isolation from the rest of your system, allowing to restrict access to resources (files, networking, memory, etc.). https://gendignoux.com/blog/2019/11/09/profiling-rust-docker-perf.html https://gendignoux.com/blog/2019/11/09/profiling-rust-docker...

saghm 2y ago
I've always heard that containers don't actually provide that much by way of security, although I imagine that maybe it could provide some value as one of many layers of a more in-depth defense. Is what I've heard correct here, or am I maybe missing some nuance?
- khafra 2y ago
  I think there's a somewhat fine distinction to be made, here. An analogy is chroot. It's not a "security tool," and there are many ways to break out of a chroot jail, but it does provide some isolation, and that does provide a measure of security. If you run an application inside a container, and you have that container well-configured, it's going to be harder for someone with an RCE on that application to affect the rest of your system than if you weren't running that application in a container. But a container does not provide a security boundary in the same sense as the security boundary between kernel mode and user mode.
  - CGamesPlay 2y ago
    Are you sure? I think it does provide a security boundary in a very analogous way to kernel/user mode. There are lots of ways to punch holes in that security boundary, but by default Docker provides, as far as I understood, a security boundary from the rest of the system and from other containers.
- Ar-Curunir 2y ago
  The isolation the author wants is not for security, but just to get a reproducible benchmarking environment
  - saghm 2y ago
    Ah, I see. This sounds more similar to how I've seen docker used with Rust in other places. It's interesting that it never occurred to me to think of the word "isolation" as referring to anything beyond security, but it definitely makes sense to me now that you point it out.

saghm 2y ago

I've always heard that containers don't actually provide that much by way of security, although I imagine that maybe it could provide some value as one of many layers of a more in-depth defense. Is what I've heard correct here, or am I maybe missing some nuance?

khafra 2y ago
I think there's a somewhat fine distinction to be made, here. An analogy is chroot. It's not a "security tool," and there are many ways to break out of a chroot jail, but it does provide some isolation, and that does provide a measure of security. If you run an application inside a container, and you have that container well-configured, it's going to be harder for someone with an RCE on that application to affect the rest of your system than if you weren't running that application in a container. But a container does not provide a security boundary in the same sense as the security boundary between kernel mode and user mode.
- CGamesPlay 2y ago
  Are you sure? I think it does provide a security boundary in a very analogous way to kernel/user mode. There are lots of ways to punch holes in that security boundary, but by default Docker provides, as far as I understood, a security boundary from the rest of the system and from other containers.
Ar-Curunir 2y ago
The isolation the author wants is not for security, but just to get a reproducible benchmarking environment
- saghm 2y ago
  Ah, I see. This sounds more similar to how I've seen docker used with Rust in other places. It's interesting that it never occurred to me to think of the word "isolation" as referring to anything beyond security, but it definitely makes sense to me now that you point it out.