4 ms·
basically even if the container code was perfect (and its not) theres a bunch of desgin issues security wise due to sharing the same kernel memory space. kerne
by zobzu 13y ago
basically even if the container code was perfect (and its not) theres a bunch of desgin issues security wise due to sharing the same kernel memory space.
kernel bugs affect all containers for example
- adobriyan 13y ago> kernel bugs affect all containers for example Fun fact: BSD jails have same (mis)design.
- tptacek 13y agoIt's weird to call it a "misdesign", since that attribute is fundamental to the concept.
- zobzu 13y agoyeah but they don't get the same sort of commercially-baked advertising - which will not mention the issues and make you believe it's the next big thing. also, jail has an arguably better implementation. containers, jails, etc. are useful for the right scenarios of course. But I question their usefulness as "vm-replacements". For the reason tptacek presented the long list of similar possibilities. It's complex and thus it's hard to secure.
- dap 13y agoHypervisor bugs affect all VMs. Switch failures affect all connected systems. Thinking about fault domains is important, but it's only part of the picture.
- zobzu 13y agohypervisors don't expose the same attacker surface as a complete kernel. its a huge difference. nothing's unbreakable tho :)