3 ms·

This is a really good concept. Not sure docker as configured will provide sufficient isolation, but with strict SElinux/AppArmor controls it is going to be way

This is a really good concept. Not sure docker as configured will provide sufficient isolation, but with strict SElinux/AppArmor controls it is going to be way better than just hoping something you got from a PPA/pip/npm is safe. It is also good to see this as a security-in-depth component. Maybe those bash exploits wouldn't have been so catastrophic if everything touching the outside world was confined by default. Also, since writing SElinux controls is so hard, this is a great way to package those controls for end users.

timthelion 12y ago
Docker knows how to automatically configure AppArmor and SELinux to contain the containers. Seems almost redundant, but if you like checking twice, that's definitely a supported feature of Docker.
- angry_octet 12y ago
  You are over simplifying. The generic policies that are applied to an LXC instance are a trade-off between usability and security. A tightly bounded security policy will allow possibly correct behavior and nothing more, and this is very specific to the program. Additionally, different parts of the program may need different policies. For example, qmail is structured to have components with different confinment policies. (See http://linux.die.net/man/8/qmail_selinux http://linux.die.net/man/8/qmail_selinux). In fact many programs need to be restructured in this way. It is noticeable that Mac App Store programs are given very limited access and many needed to be extensively modified (http://arstechnica.com/apple/2011/07/mac-os-x-10-7/9/ http://arstechnica.com/apple/2011/07/mac-os-x-10-7/9/). It seems Ubuntu is on the same course: https://wiki.ubuntu.com/SecurityTeam/Specifications/ApplicationConfinement https://wiki.ubuntu.com/SecurityTeam/Specifications/Applicat...