Re:Kata Containers: The speed of containers, the security of...
by amluto on Wednesday October 04, 2023 @09:34AM
(#37764926)
I would argue that the selinux and uid issues with podman are selinux and posix DAC’s fault.
Selinux is neat but is IMO conceptually wrong in a container world. UIDs and are barely better. At most, these mechanisms should confirm that the container as a whole has a given permission, and that’s it.
(Seriously, the major clouds have deprecated per-object permissions on their object stores. IMO they are right to have done so.)
Selinux is neat but is IMO conceptually wrong in a container world. UIDs and are barely better. At most, these mechanisms should confirm that the container as a whole has a given permission, and that’s it.
(Seriously, the major clouds have deprecated per-object permissions on their object stores. IMO they are right to have done so.)