Re:Show HN: Run Code Snippets in Any Language Inside Your Blog
by wyldfire on Thursday August 10, 2017 @03:49PM
(#14983446)
> Our platform uses Docker images to run the code
Hopefully you've already thought this through and you left out all of the copious complex security details of the sandboxing out of this announcement.
But just in case you haven't:
- containers don't provide the best sandboxing on their own
- if I get sufficient privilege in your container, I can read/write directly to the device nodes inside the container to impact the host
- you should also fear cryptocurrency miners burning your cycles
But, kudos to you -- this looks like a really neat feature. A quick skim of your homepage seems to suggest that sandboxing should be core to your product's success, so I'll just hope for the best. :)
Hopefully you've already thought this through and you left out all of the copious complex security details of the sandboxing out of this announcement.
But just in case you haven't:
- containers don't provide the best sandboxing on their own
- if I get sufficient privilege in your container, I can read/write directly to the device nodes inside the container to impact the host
- you should also fear cryptocurrency miners burning your cycles
But, kudos to you -- this looks like a really neat feature. A quick skim of your homepage seems to suggest that sandboxing should be core to your product's success, so I'll just hope for the best. :)