Hacker News Reader

> Docker relies on a different sandboxing method known as containerization. ... Most modern operating system kernels now support the primitives necessary for containerization, including Linux with openvz, vserver and more recently lxc, Solaris with zones and FreeBSD with Jails.

I'd guess it's (at most) as secure as the underlying OS containerization support.

View on HN

I was asking about how the os controls access and allocation of shared resources.

Since docker uses cgroups and cgroups can limit CPU, Memory, I/O, i guess this blog post by the docker guys gives a good overview: http://blog.dotcloud.com/kernel-secrets-from-the-paas-garage...

Control Groups (cgroups)

https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt

https://access.redhat.com/site/documentation/en-US/Red_Hat_E...

Reply on news.ycombinator.com