News for hackers. Stuff that matters.

A comment on Why would anyone choose Docker over fat binaries?. Parent comment

Re:Why would anyone choose Docker over fat binaries? by Spivak on Sunday October 29, 2017 @02:40PM (#15580625)
> Second best is VMs. Containers are a distant third.

I will grant you that containers are harder to isolate since it's same problem as isolating individual processes. But there isn't really a meaningful difference between a kernel exploit and a hypervisor exploit.

[ Parent | on HN ]
Re:Why would anyone choose Docker over fat binaries? by kijiki on Sunday October 29, 2017 @03:09PM (#15580793)
Attack surface of a minimal hypervisor is way smaller than that of an entire kernel.

Take a look at Clear Containers (despite the name, actually using VMs) and their qemu-lite minimal machine type.

[ Parent | on HN ]