3 ms·
> Docker relies on a different sandboxing method known as containerization. ... Most modern operating system kernels now support the primitives necessary for co
by karlmdavis 13y ago
> Docker relies on a different sandboxing method known as containerization. ... Most modern operating system kernels now support the primitives necessary for containerization, including Linux with openvz, vserver and more recently lxc, Solaris with zones and FreeBSD with Jails.
I'd guess it's (at most) as secure as the underlying OS containerization support.
- jamesaguilar 13y agoI was asking about how the os controls access and allocation of shared resources.
- buster 13y agoSince docker uses cgroups and cgroups can limit CPU, Memory, I/O, i guess this blog post by the docker guys gives a good overview: http://blog.dotcloud.com/kernel-secrets-from-the-paas-garage-part-24-c http://blog.dotcloud.com/kernel-secrets-from-the-paas-garage...
- sciurus 13y agoControl Groups (cgroups) https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Resource_Management_Guide/ https://access.redhat.com/site/documentation/en-US/Red_Hat_E...