3 ms·
If "security" is the reason you're switching to Podman, I have some bad news. Linux gets a new privilege escalation exploit like once a month. If something wou
by 0xbadcafebee 1y ago
If "security" is the reason you're switching to Podman, I have some bad news.
Linux gets a new privilege escalation exploit like once a month. If something would break out of the Docker daemon, it will break out of your own user account just fine. Using a non-root app does not make you secure, regardless of whatever containerization feature claims to add security in your own user namespace. On top of all that, Docker has a rootless mode. https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/
The only things that will make your system secure are 1) hardening every component in the entire system, or 2) virtualization. No containers are secure. That's why cloud providers all use mini-VMs to run customer containers (e.g. AWS Fargate) or force the customer to manage their own VMs that run the containers.
- amclennon 1y ago> That's why cloud providers all use mini-VMs to run customer containers (e.g. AWS Fargate) or force the customer to manage their own VMs that run the containers. This is only partially true. Google's runtime (gvisor) does not share a kernel with the host machine, but still runs inside of a container.
- s_ting765 1y agoGoogle cloud dropped gVisor in favor of micro VMs. https://cloud.google.com/blog/products/serverless/cloud-run-jobs-and-second-generation-execution-environment-ga https://cloud.google.com/blog/products/serverless/cloud-run-...
- carwyn 1y agoSecond generation moved away from gVisor: https://cloud.google.com/blog/products/serverless/cloud-run-jobs-and-second-generation-execution-environment-ga https://cloud.google.com/blog/products/serverless/cloud-run-...
- amclennon 1y agoAh, today I learned