4 ms·
It's both. Everyone using docker benefits from the "software distribution" feature. Some people using docker also benefit from the security and isolation featur
by shykes 13y ago
It's both. Everyone using docker benefits from the "software distribution" feature. Some people using docker also benefit from the security and isolation features - it depends on your needs and the security profile of your application. Because the underlying namespacing features of the kernel are still young, it's recommended to avoid running untrusted code as root inside a container on a shared machine. If you drop privileges inside the container, use an additional layer of security like SELinux, grsec, apparmor etc. then it is absolutely possible and viable in production.
It's only a matter of time before linux namespaces get more scrutiny and people grow more comfortable with them as a first-class security mechanism. It took a while for OpenVZ to get there, but not there are hosting providers using it for VPS offerings.
On top of namespacing, docker manages other aspects of the isolation including firewalling between containers and the outside world (currently optional but soon to be mandatory), whitelisting of traffic between certain containers, etc.
- pradn 13y agoWhich namespacing features are still young? Is it still possible to evade LXC as described in this post? http://blog.bofh.it/debian/id_413 http://blog.bofh.it/debian/id_413
- shykes 13y agoTo my knowledge there are currently no known exploits. It's more a matter of risk management: newer codebases are less secure because we had less time to find bugs and spread best practices. That problem is amplified for larger codebases (but diminished by a more active developer community).
- throwaway092834 13y agoYes, it is trivial for a root user in an LXC container to break out. One can load a kernel module from within a container, for example. LXC containers do not provide security partitioning at all.
- shykes 13y agoThis is just totally wrong. Any decent container configuration (including the default docker configuration) will agressively drop capabilities, preventing you from doing this, and any other script-kiddie attack. See my other comment in this thread for a more accurate answer.
- throwaway092834 13y agoNot wrong at all. He asked about LXC. Privilege restrictions are not part of LXC.
- justincormack 13y agoYes, you probably need a proper kernel vulnerability, which you can exploit in a reduced environment. Not trivial, but not impossible, scanning this years CVEs some would probably be sufficient (eg ones that only nees socket access).
- riquito 13y agoCan't you take advantage of a kernel vulnerability on any reduced environment, regardless of LXC?
- throwaway092834 13y agoNot in certain container types such as a full VM.