3 ms·
Once you have set up the namespaces you drop all capabilities so if the program gets hacked while it's running it can do very little.
by z3t4 2y ago
Once you have set up the namespaces you drop all capabilities so if the program gets hacked while it's running it can do very little.
- denhamparry 2y agoEdera developer here. I agree! But there are instances we need to run with additional capabilities, and we’re also dependent on people knowing how to do the right thing. We’re trying to improve this by setting this by default, but also improving the overall performance and efficiency of running containers
- znpy 2y agohonest question: how is this any better than running non-root containers? They can do very little anyway, that way.
- sys_call 2y agoNon-root containers still operate under a shared kernel. Non-root containers that run under a vulnerable kernel can lead to privilege escalation and container escapes. Styrolite is a container runtime engine that runs containers in a virtual machine guest environment with no shared kernel state. It uses a type 1 hypervisor to fully isolate a running container from the node and other containers. It's similar to Firecracker or Kata containers, but doesn't require bare metal instances (runs on standard EC2, etc) and utilizes paravirtualization.
- deleted 2y ago[deleted]