Kata Containers: The speed of containers, the security of VMs

Re:Kata Containers: The speed of containers, the security of... by irusensei on Wednesday October 04, 2023 @06:34AM (#37763205)

I find Podman frustrating at times because of how strict is with ACLs, UID maps and its integrations with SELINUX. I've had a chown/chmod -R of my own home folder (for migration purposes) cripple all podman (AND toolbox) related stuff for my user.

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by pjmlp on Wednesday October 04, 2023 @06:50AM (#37763323)

Security is a pain, however cleaning up after the fact is even worse.

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by amluto on Wednesday October 04, 2023 @09:34AM (#37764926)

I would argue that the selinux and uid issues with podman are selinux and posix DAC’s fault.

Selinux is neat but is IMO conceptually wrong in a container world. UIDs and are barely better. At most, these mechanisms should confirm that the container as a whole has a given permission, and that’s it.

(Seriously, the major clouds have deprecated per-object permissions on their object stores. IMO they are right to have done so.)

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by nicce on Wednesday October 04, 2023 @01:39PM (#37768808)

It might feel frustrating, but there is a great reason. It gives you a more secure environment. When Docker just "works", you are unaware of the fact that you have given more permissions than app might actually need, increasing the attack vector.

Podman's use of SELinux prevents and mitigates many of these issues what you will have if somone targets your app.

[ Parent | on HN ]