2 ms·

My mental model of container escapes is that they are security bugs which get patched when they are reported, and none of the mainstream, actively maintained co

• tptacek 1y ago
  That's going a bit far; a good mental model is that every kernel LPE is a sandbox escape (that's not precisely true but is to a first approximation), and kernel LPEs are pretty routine and rarely widely reported. A good heuristic would be that unless you have reason to think you're a target, containers are a safe bet. A motivated attacker probably can pop most container configurations. Also, it can be counterintuitive what makes you a target: * Large-scale cotenant work? Your target quotient is the sum of those of all your clients. * Sharing infrastructure (including code supply chains) with people who are targeted? Similar story. But for people just using Claude in YOLO mode, "security" is not really a top-of-mind concern for me, so much as "wrecking my dev machine".