17 ms·
One of the biggest issues with Docker is security more than anything else. You can't really rely on container separation in a shared environment if someone some
by kbar13 12y ago
One of the biggest issues with Docker is security more than anything else. You can't really rely on container separation in a shared environment if someone somehow plans on selling Docker containers.
- twelve40 12y agoI was surprised i didn't see it mentioned in the post. VM-style isolation is there for a reason. Dunno if Docker is the wave of the future, but as a Heroku(AWS?) killer would be nice to learn how sharing all this performance goodness on the same system is resolved isolation-wise.
- shykes 12y agoDocker and Heroku use the exact same sandboxing technology under the hood (Linux namespaces and cgroups). This is not surprising since Docker came out of Dotcloud, a direct Heroku competitor. The pros and cons of linux namespaces have been extensively discussed, it's no silver bullet but when used properly is quite robust and is rapidly gaining industry recognition.
- wmf 12y agoYet Heroku relies on container separation, don't they?
- general_failure 12y agoHeroku can run containers as non root
- zobzu 12y agoEventually this will work with docker as well when distros enable user namespaces. but that doesnt change that you share the same kernel, which isnt going to be as good as running a kernel per container security wise.
- ma2rten 12y agoYou can use SELinux to secure containers.
- ryanburk 12y agoyou have to be careful how you define "secure" here. you are correct that selinux is a requirement if you are worried at all about x-container interaction. but even with selinux, you are still exposed since you are sharing the kernel and would have to do work for top, ps, and others to not share what is going on across the system.