8 ms·
> Docker containers are, by default, quite secure; especially if you take care of running your processes inside the containers as non-privileged users (i.e., no
by anonova 11y ago
> Docker containers are, by default, quite secure; especially if you take care of running your processes inside the containers as non-privileged users (i.e., non-root).
I'm not quite seeing the sense of insecurity here, especially from the conclusion. Like any piece of software, it's up the user to not use "dangerous" configurations.
- azernik 11y agoExcept that the default is for processes inside containers to run as root. So, "by default, quite secure; except this one default that exposes you to some very nasty attacks unless you override it".
- marcosdumay 11y agoLinux containers are at most a privilege escalation away from breaking. Also, isn't Docker people the ones talking about unikernels? Where everything run not only with superuser powers, but at kernel level?
- rmgraham 11y agoThough in a Unikernel, the kernel only implements what is needed to run the service. So a database, for example, would be lacking functionality like a shell to escape to.. or even a TTY to run that shell on.. or an implementation of connect() to even initiate outbound TCP connections, in the extreme case.