2 ms·

Pardon my ignorance, but I thought the whole point of containers could be summarized as sacrificing security for performance. Wrapping containers in a single VM

• antocv 12y ago
  > point of containers could be summarized as sacrificing security for performance No. Containers are and can be secure, perhaps even more so than QEMU/KVM Id argue, see latest lxc - you can run it without root and with seccomp syscall whitelist (if not in lxc that feature is in firejail, or a simple .c to setup yourself). Its only docker that is fundamentally insecure. First it runs a server as root, second it has a server-client architecture with quite complicated communication between them. Then it also has an API and talks to various indexes/registries, also vector of attack. With say firejail, its only one process, no server-client, no registries, the whole thing is in a few hundred lines of C. The performance penalty - is somewhat bigger memory usage - and startup time, thats it, with hardware accelerated virtualization which most computers have these days, the performance impact once the VM is up and running, is negligble.