4 ms·
You've cited kernel 3.1.5 which was literally a couple of years ago. As for the rest of your resources, they are LXC without Docker. Docker is the special sau
by yebyen 13y ago
You've cited kernel 3.1.5 which was literally a couple of years ago. As for the rest of your resources, they are LXC without Docker. Docker is the special sauce that makes MongoDB WebScale.
No really... if Containers are not for security, Namespaces and CGroups are. I won't pretend to know what SElinux does, or exactly how all of this works, docker does not purport to be production ready, but I would think that sharing the box with someone else would be the fastest way to find out if it can be broken.
(Upvote for at least showing some good research.)
- susi22 13y agoSee... This is exactly what I'm trying to tell people here on HN. A few weeks back there were discussion about SmartOS, then Zones, Containers, Virtualization, Para-Virt. etc. etc.. Most people here on HN had very little knowledge about Zones/Containers a few months ago. Right now people seem to think Containers are just as good as Virtualization (and can replace it) but have a better IO performance due to all having one Kernel. The problem is: It is _not_ going to replace Virtualization any time soon since the security is missing. It's very very easy to break out of a Container, heck even a Zone. This is exactly what I'm trying to preach. You can put different users on Containers (what we do with ~1000 Users) but you can't give them root or you've compromised the entire host. The first link to suse.com should be valid enough. If you want to know the details about security and if it can be done, I'd suggest mailing the lxc user list. I'm just trying to debunk this myth that Container are just like super fast and easy Virtual Machines. They are not (at least not yet).