Hacker News Reader

Comment by pritambaral | Hacker News Reader

> They claim that "standard containers" cannot run a full OS. ... this works just fine with rootless podman and, more recently, rootless docker.

> Anyone who wants unprivileged system containers might want to look into rootless docker or podman rather than this.

Perhaps I'm missing something, but I have been running full OS userlands using "standard containers" in production for years, via LXD[1].

[1]: https://linuxcontainers.org/

View on HN

LXD is great, but one nice feature of Sysbox is that it's an OCI-based runtime, and therefore integrates with Docker, K8s, etc. In a way, Sysbox turns Docker containers or Kubernetes pods into LXD-like containers, although there are differences.

LXD uses privileged containers, though - this exposes a lot more attack surface, since uid 0 inside the container equals uid 0 outside.

It can do both. https://linuxcontainers.org/lxc/security/

That’s not true:

> By default containers are unprivileged […]

https://linuxcontainers.org/lxd/docs/master/security/#contai...

As for LXC:

> LXC containers can be of two kinds:

> - Privileged containers

> - Unprivileged containers

> […]

> The latter has been introduced back in LXC 1.0 (February 2014) […]

https://linuxcontainers.org/lxc/security/

I have always used it for unprivileged containers, and I remember using it as such in 2016. IIRC both podman and rootless docker are much more recent.

Reply on news.ycombinator.com