Hacker News Reader

Comment by throwaway613834 | Hacker News Reader

I don't do Docker but from what I've heard it's not designed for security? Which means it wouldn't work for this scenario? Or am I misinformed?

View on HN

Security without context is ambiguous and vague. To the parent comment - which asks about shipping and paying for "M" processes, docker is a reasonable (if not great) solution as container/namespace/process isolation are all, one way or another, sharing the same kernel and have mostly the same benefits/drawbacks.

I think "Security" in this context would roughly mean "able to run code from >1 user as securely (or more) than if they were running on separate VMs". Which AFAICT docker & linux cannot provide, but something like triton can.

Docker is just regular processes limited by a bunch of Linux kernel isolation mechanisms, which means that you're subject to potential kernel exploits, which would allow a "neighbor" container to run code outside the container and then control your own.

There are some ways of mitigating this, but the simplest one would be for the provider to run a VM for each container, then you get the security guarantees of regular VMs (though you still have to trust the provider to keep the OS up to date).

Is a docker container simply a process or is it more heavy weight than that? It certainly can be, so isn't this characterization that it's merely a "process" a bit disingenuous?

https://unix.stackexchange.com/questions/216618/what-do-the-...

Processes, not process, and I was talking in terms of security, but even in terms of performance, yes, it mostly is. There are some Docker features that can be more expensive (NAT and layered filesystem), but they are optional. A "Docker container" itself is just a group of processes to which the kernel applies a different policy than the default.

I'm not sure what that link is supposed to show, can you be more clear?

> I don't do Docker but from what I've heard it's not designed for security? Which means it wouldn't work for this scenario?

Are you asking if that's what you've heard?

Reply on news.ycombinator.com