3 ms·
cgroups are part of whats used to implement docker and podman
by ape4 8mo ago
cgroups are part of whats used to implement docker and podman
- ijustlovemath 8mo agoTrue, and they do indeed offer an additional layer of protection (but with some nontrivial costs). All (non-business killing) avenues should be used in pursuit of defense in depth when it comes to sandboxing. You could even throw a flatpak or firejail in, but that starts to degrade performance in noticeable ways (though I've found it's nice to strive for this in your CI).
- TingPing 8mo agoNamespaces are very lightweight though? Like single digit overhead.