Heroku Announces New Version: “Celadon Cedar”

Re:Heroku Announces New Version: “Celadon Cedar” by klaruz on Tuesday May 31, 2011 @12:35PM (#2603253)

"LXC used as a container for all dynos running on Celadon Cedar"

Has anybody published a complete SELinux or SMACK policy to use LXC with untrusted users? Last I checked LXC wasn't fully ready yet.

[ Parent | on HN ]

Re:Heroku Announces New Version: “Celadon Cedar” by peregrinari on Tuesday May 31, 2011 @12:38PM (#2603274)

Very interested to hear this as well. Anyone from Heroku can comment?

[ Parent | on HN ]

Re:Heroku Announces New Version: “Celadon Cedar” by mmcgrana on Tuesday May 31, 2011 @02:24PM (#2603784)

LXC is one of several isolation layers used in the Heroku dyno manifold to ensure process security and resource guarantees. Here is a more in-depth discussion of Heroku dyno isolation: http://devcenter.heroku.com/articles/dyno-isolation.

[ Parent | on HN ]

Re:Heroku Announces New Version: “Celadon Cedar” by klaruz on Tuesday May 31, 2011 @10:00PM (#2605579)

So LXC is fully secure now if you stick to chroot?

http://www.mail-archive.com/[email protected]/...

[ Parent | on HN ]

Re:Heroku Announces New Version: “Celadon Cedar” by shykes on Wednesday June 01, 2011 @12:08AM (#2605911)

You can't contain root in lxc. It's great for unprivileged users, though.

[ Parent | on HN ]