How the modern containerization trend is exploited by attackers

Re:How the modern containerization trend is exploited by att... by cookiecaper on Wednesday June 13, 2018 @05:00PM (#17306896)

Yep. Even full virtualization isn't truly sandboxed, but the sandbox is much tighter.

FreeBSD has jails and Solaris has zones, both of which were designed to be safe sandboxes for OS-level virtualization or "containerization" as it's called today. The consensus, as far as I can tell, is that these are pretty safe/strict, at least as far as "provide a safe environment to execute untrusted code" goes.

On Linux, resource control mechanisms like cgroups and namespaces have been co-opted to simulate secure sandboxes, but it's not the same as actually providing them.

[ Parent | on HN ]

Re:How the modern containerization trend is exploited by att... by paulddraper on Wednesday June 13, 2018 @05:12PM (#17306987)

FWIW, AWS Fargate -- which uses Docker containers as the unit of virtualization -- is now HIPAA compliant.

I can't speak with authority on Docker security, but that's a data point, from the largest cloud provider in the world.

[ Parent | on HN ]