3 ms·
In a sandbox you start out with access to nothing except the apis that you explicitly expose into the sandbox. In Podman you start out with a huge attack surfac
by bborud 2y ago
In a sandbox you start out with access to nothing except the apis that you explicitly expose into the sandbox. In Podman you start out with a huge attack surface which you then have to clamp down. One of those surfaces is the kernel. Another is the network.
Using containers to run untrusted third party code is horribly risky. Containers provide nowhere nearly enough isolation and separation.
- synergy20 2y agothese days containers run well-known open source code or your own code, and are used widely in the field. Linux does have namespaces and other security approaches to safeguard them further. yes they are less secure than WASM but security is always a compromise between convenience and cost. Anyway, points taken, thanks.