Hacker News Reader

First of all - the Namespaces and Cgroups on Linux are not about security. They are about features.

FreeBSD Jails provide both secure isolation from the host and also provide the separated network namespace and resources with rctl(8) when needed.

To have Linux containers separated and secured you need additional layer for that - like SELinux or AppArmor. Only then Docker/Podman/other/... Linux containers are isolated and secure.

Regards.

View on HN

You're telling those namespace / cgroup features have nothing to do with security? Not in any way, shape, or form? I'm a little skeptical.

Namespaces and cgroups provide resource accounting and some limited isolation between trusted workloads. They're not considered a sandbox or security boundary because the processes have full access to the Linux kernel APIs, which are not well-hardened.

To provide a security boundary between Linux processes, it's currently considered best practice to use something like Firecracker or gVisor.

I agree containers are more for ease of deployment, not security. But security is about shades of gray… limited isolation is one of those.

Underrated post.

Reply on news.ycombinator.com