3 ms·
Why not Docker? (lxc)
by jafaku 12y ago
Why not Docker? (lxc)
- peterwwillis 12y agoDocker is not designed to isolate the root user from the rest of your system, and containers/capabilities are not MAC-based security. Docker strips 16 capabilities when it runs a container, leaving 23 additional capabilities to be abused by root, and whatever other vulnerabilities are left that capabilities don't cover. To prevent this you need guest isolation via virtualization. https://wiki.ubuntu.com/LxcSecurity https://wiki.ubuntu.com/LxcSecurity http://www.infoq.com/news/2013/09/docker-container-security http://www.infoq.com/news/2013/09/docker-container-security http://s3hh.wordpress.com/2013/07/19/creating-and-using-containers-without-privilege/ http://s3hh.wordpress.com/2013/07/19/creating-and-using-cont...