3 ms·
A hypervisor is the best defense you can have against running code so close to root
by lclarkmichalek 12y ago
A hypervisor is the best defense you can have against running code so close to root
- mrmondo 12y agoIt's not quite that simple, an insecure or vulnerable hypervisor can actually make it easier to exploit a system. (Note: I'm not suggesting that running Docker as PID1 or similar is a good idea)
- lclarkmichalek 12y agoI think it's fair to say that it's easier to secure a hypervisor than it is to secure a Docker daemon. Lord knows we've had a lot more experience securing hypervisors.