3 ms·
Why is Docker (or extensions thereof) not a sandbox? Granted, it could access the internet, but that's necessary.
by OutOfHere 1y ago
Why is Docker (or extensions thereof) not a sandbox? Granted, it could access the internet, but that's necessary.
- cedws 1y agoDocker's primary purpose is to give applications their own namespaces in which they can run without conflict. It does confine applications to their own root filesystem, own process namespace and so on, but this isn't intended as a security boundary. cgroup escapes happen. Firecracker and gVisor provide much stronger isolation. Both are battle tested; clouds run millions of multi-tenant workloads on these every day. Docker would simply never even be a candidate for this purpose.