3 ms·
> I prefer containers and think VMs are a huge hack for most problems. But as it stands now, the number of local root exploits vs say remote exploits on Linux i
by darkarmani 13y ago
> I prefer containers and think VMs are a huge hack for most problems. But as it stands now, the number of local root exploits vs say remote exploits on Linux is probably greater by a factor of 100 or so, so you're taking much more risk.
Yeah, but if you can run services in containers that don't need root access, you know have to exploit the services, find a privilege escalation exploit, and then run your local root exploit. If you don't give out root access in your containers, you can get the advantages of containers while minimizing the downsides.
- chubot 13y agoIn the context of PaaS, you just upload the local root exploit and run it. There's no need to exploit any services -- it's one step. The local root exploit is the privilege escalation.
- darkarmani 13y agoI'm not sure why you say that. You can have root inside a container and still not break out of it. You need an exploit that breaks you out of the container.