6 ms·

This is a bad idea. Concerns about Docker's security (or lack thereof) aside, containers provide "good enough" separation of concerns to apps. They are not secu

This is a bad idea. Concerns about Docker's security (or lack thereof) aside, containers provide "good enough" separation of concerns to apps. They are not security hardened and designed to be exposed to vulnerabilities, particularly when by design a honeypot is to tempt attacks (automated or otherwise). A virtual machine (or better) is better suited to this task.

j_s 11y ago
So why not one virtual machine hosting multiple containers?
- antocv 11y ago
  Why not several virtual machines? There are more choices and more mature software for managing thousands of virtual machines, configurations and images, than there is for docker. Also, the memory footprint of several virtual machines isnt that bigger compared to docker - because of KMS and such.
  - j_s 11y ago
    Pardon my ignorance, but I thought the whole point of containers could be summarized as sacrificing security for performance. Wrapping containers in a single VM to restore security seems like a reasonable compromise. I would be interested in learning more about the differences in management software availability as well as how KMS (KSM?) reduces the performance penalty of using virtual machines.
    - antocv 11y ago
      > point of containers could be summarized as sacrificing security for performance No. Containers are and can be secure, perhaps even more so than QEMU/KVM Id argue, see latest lxc - you can run it without root and with seccomp syscall whitelist (if not in lxc that feature is in firejail, or a simple .c to setup yourself). Its only docker that is fundamentally insecure. First it runs a server as root, second it has a server-client architecture with quite complicated communication between them. Then it also has an API and talks to various indexes/registries, also vector of attack. With say firejail, its only one process, no server-client, no registries, the whole thing is in a few hundred lines of C. The performance penalty - is somewhat bigger memory usage - and startup time, thats it, with hardware accelerated virtualization which most computers have these days, the performance impact once the VM is up and running, is negligble.

j_s 11y ago

So why not one virtual machine hosting multiple containers?

antocv 11y ago
Why not several virtual machines? There are more choices and more mature software for managing thousands of virtual machines, configurations and images, than there is for docker. Also, the memory footprint of several virtual machines isnt that bigger compared to docker - because of KMS and such.
- j_s 11y ago
  Pardon my ignorance, but I thought the whole point of containers could be summarized as sacrificing security for performance. Wrapping containers in a single VM to restore security seems like a reasonable compromise. I would be interested in learning more about the differences in management software availability as well as how KMS (KSM?) reduces the performance penalty of using virtual machines.
  - antocv 11y ago
    > point of containers could be summarized as sacrificing security for performance No. Containers are and can be secure, perhaps even more so than QEMU/KVM Id argue, see latest lxc - you can run it without root and with seccomp syscall whitelist (if not in lxc that feature is in firejail, or a simple .c to setup yourself). Its only docker that is fundamentally insecure. First it runs a server as root, second it has a server-client architecture with quite complicated communication between them. Then it also has an API and talks to various indexes/registries, also vector of attack. With say firejail, its only one process, no server-client, no registries, the whole thing is in a few hundred lines of C. The performance penalty - is somewhat bigger memory usage - and startup time, thats it, with hardware accelerated virtualization which most computers have these days, the performance impact once the VM is up and running, is negligble.