zlacker

that's a really good point .. but, I think 99% of docker users believe it is a a sandbox and treat it as such.

>>socalg+(OP)
And not without cause. We've been pitching docker as a security improvement for well over a decade now. And it is a security improvement, just not as much as many evangelists implied.

>>socalg+(OP)
it is a sandbox against unintentional attacks and mistakes (sudo rm -rf /)

but will not stop serious malware

>>freedo+13
Must depend on who you've been talking to. Docker's not been pitched for security in the circles I run in, ever.

>>socalg+(OP)
Not 99%. Many people run an hypervisor and then a VM just for Docker.

Attacker now needs a Docker exploit and then a VM exploit before getting to the hypervisor (and, no, pwning the VM ain't the same as pwning the hypervisor).

>>Tactic+1j
'Double-bagging it' was what we called it in my day.

>>Tactic+1j
Agreed - this is actually pretty common in the Proxmox realm of hosters. I segment container nodes using LXC, and in some specific cases I'll use a VM.

Not only does it allow me to partition the host for workloads but I also get security boundaries as well. While it may be a slight performance hit the segmentation also makes more logical sense in the way I view the workloads. Finally, it's trivial to template and script, so it's very low maintenance and allows for me to kill an LXC and just reprovision it if I need to make any significant changes. And I never need to migrate any data in this model (or very rarely).