4 ms·
Isolation is possible in a multi-user system with text-mode apps (ncurses and such), just xorg presents a privilege hole that can't be easily plugged. One way t
by iwwr 12y ago
Isolation is possible in a multi-user system with text-mode apps (ncurses and such), just xorg presents a privilege hole that can't be easily plugged. One way to do it may be to run a separate instance of X inside the container and access it via VNC from the host system.
- skybrian 12y agoIt looks like the situation is somewhat better in Wayland? http://mupuf.org/blog/2014/02/19/wayland-compositors-why-and-how-to-handle/ http://mupuf.org/blog/2014/02/19/wayland-compositors-why-and...
- TD-Linux 12y agoAbsolutely. This was one of the main reasons that the Wayland protocol was written.
- eropple 12y agoWayland is another, probably simpler, alternative. One thing, though: Docker itself presents a privilege hole that can't be easily plugged, too. That's a large part of why I've expressed alarm upthread.