Re:M1 dev setup with a virtual Linux box
by fpoling on Sunday April 11, 2021 @07:12AM
(#26769441)
A properly secured unprivileged Linux container is not particularly worse than VM from a security point of view, but its impact on performance is very minimal. The drawback is that one cannot use Mac or Windows as a host, but as long as one is OK with running Linux on machine and accessing, say, Windows occasionally via VM, this is a very nice setup.
[ Parent
| on HN ]
My first attempt at this configuration was using a podman container (my laptop runs Fedora).
It worked well, except that I occasionally want to run a container within my dev-environment. Running a container inside a container is possible, but not easy.
I settled on running a Vagrant Libvirt VM. I do not know what the performance impact is- but I have not noticed either my laptop or the VM being slow.
I'm just now learning about the container technologies that are alternatives to Docker. More precisely, LXC, in case you had it in mind in your comment.
Do you know of a set of settings or tips to follow for making containers as safe as a VM?
I use systemd-nspawn containers with max security options, like user namespaces, syscall filters, no-new-priveleges. Even with the user namespaces I do not run as a root in the user namespaces unless I need to install extra software inside the container.