5 ms·
Why not combine the two and get the value of both? And, a reminder, you can still use LXC with Docker. It's fully supported.
by nickstinemates 13y ago
Why not combine the two and get the value of both? And, a reminder, you can still use LXC with Docker. It's fully supported.
- brokenparser 13y agoBecause the guests have their own SELinux policies. Docker containers don't come with policies, but if it would support running containers under a user account I could at least restrict each to their own category so that theoretically a chmod -R 777 / (inside a container) and access to the host wouldn't compromise other containers (unless the kernel is exploitable, in which case KVM would still win).
- nickstinemates 13y agoMaybe we're talking past each other here, but, Dan Walsh, author of SELinux, is working to bring SELinux natively to libcontainer / docker. I'd love to talk more about your needs and how we can help. My email is always open - nick@docker.com