Docker (and containers in general) adds namespacing, but not security, for applications. If anything, docker can add MORE attack vectors.
No one should use containers primarily for security ever.
No one should use containers primarily for security ever.
There is a world that exists outside your own use cases (and gke). EKS provides isolation by default, just as one example I can pull from my own career. you can even get warnings out of the box if any process gets access to the host, and the typical convention is to lock these hosts down entirely. No need to access the machine at all and everything is isolated within it.
Generally the type of infra advice AWS provides is fairly sound depending on what you want to pay, but I assure you what you just said is not true everywhere.
As far as my understanding goes containers per se are no security mechanism. Rootless containers are as good as rootless processes with chroot.
So this comment resonates with my understanding.
My feeling is that containers give you more possibilities to introduce security holes if you aren't diligent.
But I don't disagree about rootless containers being more secure than rooted ones, just as much as any process not running as root has less privileges then one running as root.
My 'toy' controller/replica are production but due to planning - have no weight. Two people care in the 'oh that's mildly inconvenient' sense when they break. Everything moves on.
To lean into hyperbole a bit: for every shop that's rootless, there are nine that are rootful.
I don't say any of this to be defeatist, more... realistic. There's:
1) what people say they do
2) what people actually do
It's surely trending positively, but I'm also not interested in arguing about window dressing while the house is on fire.
What does SELinux or AppArmor look like in this hypothetical, disabled per usual? Plenty of work to do. No pats on the back yet.
I say all of this a bit heavily - not OP. Closely related to some heated talks I've had this week. It's easy to bike-shed endlessly