Hacker News Reader

Comment by kbar13 | Hacker News Reader

One of the biggest issues with Docker is security more than anything else. You can't really rely on container separation in a shared environment if someone somehow plans on selling Docker containers.

View on HN

I was surprised i didn't see it mentioned in the post. VM-style isolation is there for a reason. Dunno if Docker is the wave of the future, but as a Heroku(AWS?) killer would be nice to learn how sharing all this performance goodness on the same system is resolved isolation-wise.

Docker and Heroku use the exact same sandboxing technology under the hood (Linux namespaces and cgroups). This is not surprising since Docker came out of Dotcloud, a direct Heroku competitor. The pros and cons of linux namespaces have been extensively discussed, it's no silver bullet but when used properly is quite robust and is rapidly gaining industry recognition.

Yet Heroku relies on container separation, don't they?

Heroku can run containers as non root

Eventually this will work with docker as well when distros enable user namespaces.

but that doesnt change that you share the same kernel, which isnt going to be as good as running a kernel per container security wise.

You can use SELinux to secure containers.

you have to be careful how you define "secure" here. you are correct that selinux is a requirement if you are worried at all about x-container interaction. but even with selinux, you are still exposed since you are sharing the kernel and would have to do work for top, ps, and others to not share what is going on across the system.

Reply on news.ycombinator.com