3 ms·

I wouldn't want to run code from a third party in a container.

• synergy20 2y ago
  why is that? how is it different from WASM? podman can be rootless, and it runs inside its own sandbox on the server side as much as WASM runtime does. Plus there are many sandbox options on linux for podman.
  • bborud 2y ago
    In a sandbox you start out with access to nothing except the apis that you explicitly expose into the sandbox. In Podman you start out with a huge attack surface which you then have to clamp down. One of those surfaces is the kernel. Another is the network. Using containers to run untrusted third party code is horribly risky. Containers provide nowhere nearly enough isolation and separation.
    • synergy20 2y ago
      these days containers run well-known open source code or your own code, and are used widely in the field. Linux does have namespaces and other security approaches to safeguard them further. yes they are less secure than WASM but security is always a compromise between convenience and cost. Anyway, points taken, thanks.