4 ms·
honest question: how is this any better than running non-root containers? They can do very little anyway, that way.
by znpy 2y ago
honest question: how is this any better than running non-root containers?
They can do very little anyway, that way.
- sys_call 2y agoNon-root containers still operate under a shared kernel. Non-root containers that run under a vulnerable kernel can lead to privilege escalation and container escapes. Styrolite is a container runtime engine that runs containers in a virtual machine guest environment with no shared kernel state. It uses a type 1 hypervisor to fully isolate a running container from the node and other containers. It's similar to Firecracker or Kata containers, but doesn't require bare metal instances (runs on standard EC2, etc) and utilizes paravirtualization.
- deleted 2y ago[deleted]