4 ms·

Docker knows how to automatically configure AppArmor and SELinux to contain the containers. Seems almost redundant, but if you like checking twice, that's defi

• angry_octet 12y ago
  You are over simplifying. The generic policies that are applied to an LXC instance are a trade-off between usability and security. A tightly bounded security policy will allow possibly correct behavior and nothing more, and this is very specific to the program. Additionally, different parts of the program may need different policies. For example, qmail is structured to have components with different confinment policies. (See http://linux.die.net/man/8/qmail_selinux http://linux.die.net/man/8/qmail_selinux). In fact many programs need to be restructured in this way. It is noticeable that Mac App Store programs are given very limited access and many needed to be extensively modified (http://arstechnica.com/apple/2011/07/mac-os-x-10-7/9/ http://arstechnica.com/apple/2011/07/mac-os-x-10-7/9/). It seems Ubuntu is on the same course: https://wiki.ubuntu.com/SecurityTeam/Specifications/ApplicationConfinement https://wiki.ubuntu.com/SecurityTeam/Specifications/Applicat...