3 ms·
At the moment, the container host exposes any kernel vulnerability to the container guests; that's a large enough attack surface that the advice I've most frequ
by regularfry 12y ago
At the moment, the container host exposes any kernel vulnerability to the container guests; that's a large enough attack surface that the advice I've most frequently come across is "Run your customer's containers in a VM so they can't attack your host". That's obviously less than ideal, so if VT-* can add a layer of isolation such that I don't need a VM layer in the infrastructure, it's worth it.
- feld 12y agoSo you're not longer sharing a kernel with the host?
- regularfry 12y agoThe VM doesn't share a kernel with the host, no. Without knowing exactly what virtualisation knobs Canonical are planning on adding here, it's difficult to say how much isolation is on the table.