Subuser – Securing the Linux desktop with Docker | Hacker News Reader

Subuser – Securing the Linux desktop with Docker

subuser.org

6 pointstakluyver11 comments

This is a really good concept. Not sure docker as configured will provide sufficient isolation, but with strict SElinux/AppArmor controls it is going to be way better than just hoping something you got from a PPA/pip/npm is safe. It is also good to see this as a security-in-depth component. Maybe those bash exploits wouldn't have been so catastrophic if everything touching the outside world was confined by default.

Also, since writing SElinux controls is so hard, this is a great way to package those controls for end users.

Docker knows how to automatically configure AppArmor and SELinux to contain the containers. Seems almost redundant, but if you like checking twice, that's definitely a supported feature of Docker.

"Download Source" vs "Star/Fork/Issues/Pull Requests" at GitHub? Is it just me, but when I see a project not using GitHub/Bitbucket, its credibility drops drastically? Of course, there are others like Linux distros, GNU, etc., but we know and understand the motivation there.

What is the issue? They're using Github: https://github.com/subuser-security/subuser

The issue is that it's no where on the webpage and the download is not from GitHub either.

Erm, that Github link is the "Download source" link

Maybe it is now, but not when this got posted hours and hours ago.

Look, I did that on purpose. I don't want to make a brand name, Github, into a synonym for open source.

I have to agree with you given your point.

> Is it just me, but when I see a project not using GitHub/Bitbucket, its credibility drops drastically?

It may be just you. Why does the credibility drop if it isn't using GitHub/BitBucket as long as the code is available easily?

I doubt it's just me though. Our lives are driven by heuristics and one of those is: "If something deviates from the norm, it's risky." For good or bad, the norm today is GitHub.

Reply on news.ycombinator.com