2 ms·
apparently... Like it's also possible in a VM. What about running non privileged containers! You need really to open some doors to make it easier!
by mehdibl 1y ago
apparently...
Like it's also possible in a VM.
What about running non privileged containers! You need really to open some doors to make it easier!
- Scramblejams 1y agoBetter not rely on unprivileged containers to save you. The problem is: Breaking out of a VM requires a hypervisor vulnerability, which are rare. Breaking out of a shared-kernel container requires a kernel syscall vulnerability, which are common. The syscall attack surface is huge, and much of it is exploitable even by unprivileged processes. I posted this thread elsewhere here, but for more info: https://news.ycombinator.com/item?id=32319067 https://news.ycombinator.com/item?id=32319067