Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

Re:Show HN: Apply for a job through SSH, $ ssh jobs.hackclub... by airhead969 on Tuesday May 18, 2021 @09:04AM (#27194020)

Docker containers aren't provably secure. If you want isolation, use a VM that doesn't have host file system access. This way, if the VM is compromised, just throw it away and it can't leak out the way containers do.

[ Parent | on HN ]

Re:Show HN: Apply for a job through SSH, $ ssh jobs.hackclub... by px43 on Tuesday May 18, 2021 @09:14AM (#27194122)

> Docker containers aren't provably secure.

Not only are they not provably secure (very few things are), they are explicitly not intended for use as a security boundary. Their whole gimmick is lightweight containers you can use instead of VMs if you trust everyone who's going to run code under them.

[ Parent | on HN ]

Re:Show HN: Apply for a job through SSH, $ ssh jobs.hackclub... by airhead969 on Tuesday May 18, 2021 @10:59AM (#27195522)

To disambiguate: I don't mean formal verification like seL4, I mean it hasn't been thoroughly audited to show it is reasonably secure. Docker security of images and running containers is pretty shit as I brought up on GH in the beginning. Developers just shrugged it off and focused on whiz-bang features.

The conflation of what amounts to fancy Linux cgroups trickery with hypervisors is a depressing misunderstanding of isolation.

[ Parent | on HN ]