Live data from Hacker News

Making containers safer

51–52 of 52 posts

Re: Making containers safer

#51

Post by auspex » Fri, Aug 23, 2019, 2:16 PM UTC

bscphil wrote: post #3

This was a pretty good read. I use containers quite a lot on my server at home at maintain a bunch of utilities. Mostly I'm using systemd-nspawn. > User namespaces have been around since the 3.12 kernel, but few other container management systems use the feature to isolate their containers. Part of the reason for that is the difficulty in sharing files between containers because of the UID mapping. LXD is currently u…

If the container doesn't require root. Just do a FROM image:tag and then add a User in the Dockerfile

Re: Making containers safer

#52

Post by auspex » Fri, Aug 23, 2019, 2:19 PM UTC

trabant00 wrote: post #7

I used containers in production since 2002. We knew back then that containers are escapable and nothing changed since. Containers are for ease of management - package and configuration sepparation. One role per container. In absolutely no case are they meant for multi tenant cases. Containers are fine the way they are. Just use them for the right job.

Container breakouts typically require running a "bad container" or image that contains malicious code or that has been added after the fact. With the right security tools you can create "white lists" that only allow specific image SHAs to run and that monitor (and even enforce to block) any changes to a running container.

So there are solutions out there to solve your security issues.

Post reply on HN