Rebuilding My Personal Infrastructure With Alpine Linux and Docker

Re:Rebuilding My Personal Infrastructure With Alpine Linux a... by rsync on Wednesday March 13, 2019 @11:13AM (#19379439)

""Improved security" is also a red herring. You can't make something more secure by adding an additional layer of abstraction."

I have not used docker. However, I have been putting things in containers with FreeBSD 'jail' since 2001 ...

If I jail my httpd and there is a vuln in the httpd, the attacker gets the jail (and the httpd, etc.) but not the underlying system.

That's a huge win, in my mind - is that not how it works in dockerland ?

[ Parent | on HN ]

Re:Rebuilding My Personal Infrastructure With Alpine Linux a... by weberc2 on Wednesday March 13, 2019 @12:23PM (#19380229)

Last I checked, Docker containers are not hard to break out of unless you go to extra lengths (SELinux, AppArmor, etc--not entirely sure; I'm not an expert). Most people use Docker as a way to avoid their programs accessing the wrong version of a shared dependency or similar. I believe there may be other container runtimes with stronger guarantees or better defaults, some of which are even suitable for running untrusted code (or so they advertise).

[ Parent | on HN ]

Re:Rebuilding My Personal Infrastructure With Alpine Linux a... by rsync on Wednesday March 13, 2019 @01:10PM (#19380888)

Thanks - good to know.

jail is pretty tremendous - a real win in many areas.

[ Parent | on HN ]