11 ms·

I think we've used something similar some time ago (maybe XEN?) and had the following issues, how does Docker compare: - what happens when one container changes

I think we've used something similar some time ago (maybe XEN?) and had the following issues, how does Docker compare: - what happens when one container changes the system clock? - are iptables rules per container or global?

ambiate 13y ago
As far as I understand, the clock and such are tied to the base host. Typing 'uptime' in my linux container shows 5 days, the uptime of the base host.
- justincormack 13y ago
  In theory things like the clock could be namespaced too, if anyone found it useful.
  - MrBuddyCasino 13y ago
    That would be useful - sometimes you have to change the system time to debug some code, and if that trips up all the other containers, its a deal breaker for us.
djchen 13y ago
I was thinking more like FreeBSD jails. Containers can't change the system clock.
qznc 13y ago
Networking for Docker containers is bridged, so iptables are per container. http://blog.docker.io/2013/08/containers-docker-how-secure-are-they/ http://blog.docker.io/2013/08/containers-docker-how-secure-a...
mcpherrinm 13y ago
Linux network namespaces let you have multiple independent network stacks in linux. That means routing tables, interfaces, routing tables, IP addresses, etc. Each container gets its own network namespace (along with other namespaces like hostname, pids, users, ipc, filesystem mounts). Anything not handled by one of the 6 namespaces is the same across all containers. That includes things like what kernel modules are loaded, the system clock, etc. Because a user with root can manipulate the kernel in many ways, I wouldn't give root to an untrusted user and assume containers were enough to contain them. Certainly if they can load a custom kernel module it's game over, but I'd bet there's plenty of other ways to break out too.
yrro 13y ago
See the excellent series of LWN articles, "Namespaces in operation" <https://lwn.net/Articles/531114/> https://lwn.net/Articles/531114/> for an overview of how namespaces work on Linux. To answer your time question: AFAIK there is no namespace for system time in Linux. If you don't want processes within a contaier to be able to set the system clock then don't launch them with the CAP_SYS_TIME capability.

ambiate 13y ago

As far as I understand, the clock and such are tied to the base host. Typing 'uptime' in my linux container shows 5 days, the uptime of the base host.

justincormack 13y ago
In theory things like the clock could be namespaced too, if anyone found it useful.
- MrBuddyCasino 13y ago
  That would be useful - sometimes you have to change the system time to debug some code, and if that trips up all the other containers, its a deal breaker for us.

djchen 13y ago

I was thinking more like FreeBSD jails. Containers can't change the system clock.

qznc 13y ago

Networking for Docker containers is bridged, so iptables are per container. http://blog.docker.io/2013/08/containers-docker-how-secure-are-they/ http://blog.docker.io/2013/08/containers-docker-how-secure-a...

mcpherrinm 13y ago

Linux network namespaces let you have multiple independent network stacks in linux. That means routing tables, interfaces, routing tables, IP addresses, etc. Each container gets its own network namespace (along with other namespaces like hostname, pids, users, ipc, filesystem mounts). Anything not handled by one of the 6 namespaces is the same across all containers. That includes things like what kernel modules are loaded, the system clock, etc. Because a user with root can manipulate the kernel in many ways, I wouldn't give root to an untrusted user and assume containers were enough to contain them. Certainly if they can load a custom kernel module it's game over, but I'd bet there's plenty of other ways to break out too.

yrro 13y ago

See the excellent series of LWN articles, "Namespaces in operation" <https://lwn.net/Articles/531114/> https://lwn.net/Articles/531114/> for an overview of how namespaces work on Linux. To answer your time question: AFAIK there is no namespace for system time in Linux. If you don't want processes within a contaier to be able to set the system clock then don't launch them with the CAP_SYS_TIME capability.