News for hackers. Stuff that matters.

A comment on The Evolution of Container Usage at Netflix. Parent comment

Re:The Evolution of Container Usage at Netflix by lima on Friday April 21, 2017 @10:35AM (#14165935)
SELinux is NOT isolation. The main issue is the large kernel attack surface and SELinux, while important, only solves a small part of that.
[ Parent | on HN ]
Re:The Evolution of Container Usage at Netflix by nailer on Friday April 21, 2017 @10:48AM (#14166045)
That's true, but a lot of the classic containers-not-containing issues (/sysfs hacks to get into the parent kernel etc) are prevented by SELinux policies.

See https://blog.openshift.com/securing-dockers-future-with-seli...

[ Parent | on HN ]
Re:The Evolution of Container Usage at Netflix by lima on Thursday April 27, 2017 @08:56AM (#14211063)
Agreed.

But people keep selling SELinux or AppArmor as a solution for multi-tenant container environments, which is just plain false.

The real solution are efforts like like Intel's Clear Containers and Hyper's runV.

[ Parent | on HN ]