Leaky Vessels flaws allow hackers to escape Docker, runc containers

Re:Leaky Vessels flaws allow hackers to escape Docker, runc ... by mrweasel on Sunday February 04, 2024 @12:52PM (#39252540)

Just pointing out the most VM / virtualization platforms have also had security problems where an attacker could escape the VM and access the underlying operating system.

[ Parent | on HN ]

Re:Leaky Vessels flaws allow hackers to escape Docker, runc ... by tptacek on Sunday February 04, 2024 @02:00PM (#39253220)

KVM vulnerabilities are rare compared to Linux kernel LPEs, which makes sense, because KVM is a relatively small part of the Linux kernel compared to the system call and driver attack surface. Containers are great, but shared-kernel security isolation of standard Unix programs doesn't work.

[ Parent | on HN ]

Re:Leaky Vessels flaws allow hackers to escape Docker, runc ... by flaminHotSpeedo on Sunday February 04, 2024 @01:18PM (#39252799)

The major difference is that VM's are intended to be a security boundary as a primary function, and give you tools like hardware virtualization or enforcing single tenancy for a given NUMA node to reduce the attack surface.

[ Parent | on HN ]