3 ms·
Exactly what security features do you think Docker is providing that LXC isn't?
by evol262 13y ago
Exactly what security features do you think Docker is providing that LXC isn't?
- nisa 13y agoLXC provides all the features. Except some protection that can at the moment only be provided by AppArmor or another MAC system. I'm not sure what are the LXC defaults are - But I assume that docker uses more restrictive defaults: https://github.com/dotcloud/docker/blob/master/lxc_template.go https://github.com/dotcloud/docker/blob/master/lxc_template.... I'm still learning about LXC so my post regarding security may be inaccurate. I'd just thought I'd share it because a lot of people think it's as secure as a virtual machine. I hope soon it is.
- evol262 13y agoI find the number of people schilling for Docker mindblowing. "I don't know much about LXC, and I don't know what the defaults are, but I assume that this trivial wrapper around LXC provides more security".
- nisa 13y agoSorry this was not my intention. I actually prefer LXC to docker myself and did not wanted to shill for anything. I just wanted to point out that of the (possible) security problems that can happen when using LXC docker mitigates most by just not using them: They don't allow mounts, they drop CAP_SYS_ADMIN. I just posted the config file. It was just a well intended warning - similiar to the warnings in the Ubuntu docs: https://help.ubuntu.com/12.04/serverguide/lxc.html#lxc-security https://help.ubuntu.com/12.04/serverguide/lxc.html#lxc-secur... and Gentoo: https://wiki.gentoo.org/wiki/LXC#MAJOR_Temporary_Problems_with_LXC_-_READ_THIS https://wiki.gentoo.org/wiki/LXC#MAJOR_Temporary_Problems_wi... Here is the default configuration for Ubuntu 13.10 in comparision: https://gist.github.com/anonymous/7550932 https://gist.github.com/anonymous/7550932