Hacker News Reader

No, Docker is not built for security. I do use Docker sometimes to isolate processes, but not for serious security.

if properly configured why not? What would stand in the way of implementing a secure containerized version of the workstation+gateway type setup?

You could break out of the isolation by using kernel vulnerabilities, e.g., in syscalls.

Theoretically, nothing. In practice, the isolation it relies on is somewhat weak. And in general, it is new and exciting and changing frequently, which means security bugs. Also, most people seem to rather suck at configuring it, as far as I've seen. (That's not per se a problem with Docker, but it is frequently a problem with Docker as-deployed.) And then there are potential kernel bugs.

When talking about "trusting X", one always has to answer the question "trust X to do what, exactly, under what circumstances?" I don't yet trust Docker to be secure enough for production, internet-exposed business use. I know other people disagree; YMMV.

Do you mean to implement this with Docker or just to use Docker with this OS?

nth'ing the other warnings about this approach, but thanks for mentioning whalebrew. Looks very interesting.