Containers vs. Zones vs. Jails vs. VMs

Re:Containers vs. Zones vs. Jails vs. VMs by raesene9 on Wednesday March 29, 2017 @01:43AM (#13983745)

I think it's important to make the distinction that containers do provide a level of security isolation, but that in most cases it's not as much protection as it provided by VM isolation.

There are companies doing multi-tenant Container setups, with untrusted customers, so it's not an unknown concept for sure.

what I'd say is that the attack surface is much larger than a VM hypervisor , so there's likely more risk of a container breakout than a VM one.

[ Parent | on HN ]

Re:Containers vs. Zones vs. Jails vs. VMs by dreamcompiler on Wednesday March 29, 2017 @12:16PM (#13987707)

> There are companies doing multi-tenant Container setups, with untrusted customers, so it's not an unknown concept for sure.

I'm a little shocked to hear this (given everything everybody else has said about container security), but I guess it means the security of containers can be tweaked to be good enough in this environment.

Examples?

[ Parent | on HN ]

Re:Containers vs. Zones vs. Jails vs. VMs by gjjrfcbugxbhf on Wednesday March 29, 2017 @01:40PM (#13988717)

How do you make a docker container secure? Run it in a bsd jail :p. But I'm sure that people with the right expertise can do this. For the rest of us Docker is mainly a packaging mechanism which helps alleviate accidents and makes deployment a little more predictable.

[ Parent | on HN ]