Docker Bug Allows Root Access to Host Filesystem

Re:Docker Bug Allows Root Access to Host Filesystem by nullwasamistake on Wednesday May 29, 2019 @10:26AM (#20040546)

Why don't people run containers in VM's? I don't get it, the only real selling point I can come up with for kernel level isolation is ability to over provision ram. And you shouldn't do that on a server anyways.

It's perfectly possible to fire up a regular docker container inside KVM or whatever. With constant container security issues, why isn't this the norm?

[ Parent | on HN ]

Re:Docker Bug Allows Root Access to Host Filesystem by the8472 on Wednesday May 29, 2019 @10:37AM (#20040696)

You have more benefits such as sharing resources between containers (page cache, unix sockets, reflink copies, shared memory IPC) etc.

Exposing GPU resources is also a lot easier with containers than with VMs.

[ Parent | on HN ]

Re:Docker Bug Allows Root Access to Host Filesystem by hclaria on Wednesday May 29, 2019 @10:31AM (#20040623)

that's what Intel Clear Containers and KataContainers are trying to do

https://clearlinux.org/news-blogs/intel-clear-containers-now... https://katacontainers.io/

[ Parent | on HN ]

Re:Docker Bug Allows Root Access to Host Filesystem by qalmakka on Wednesday May 29, 2019 @10:38AM (#20040714)

And also what Microsoft has been doing since a few years ago on Windows with Hyper-V isolation.

[ Parent | on HN ]

Re:Docker Bug Allows Root Access to Host Filesystem by Tepix on Wednesday May 29, 2019 @10:37AM (#20040693)

KVM requires more resources than LXC (Linux containers).

[ Parent | on HN ]