Leaky Vessels flaws allow hackers to escape Docker, runc containers

Re:Leaky Vessels flaws allow hackers to escape Docker, runc ... by flaminHotSpeedo on Sunday February 04, 2024 @01:09PM (#39252709)

Definitely not the minority, anyone who needs secure isolation for a container should be wrapping it in a single tenant VM

[ Parent | on HN ]

Re:Leaky Vessels flaws allow hackers to escape Docker, runc ... by throwoutway on Sunday February 04, 2024 @03:08PM (#39253872)

Firecracker has often been recommended (here on HN and elsewhere) for a VM-for container-execution model : https://github.com/firecracker-microvm/firecracker

[ Parent | on HN ]

Re:Leaky Vessels flaws allow hackers to escape Docker, runc ... by tptacek on Sunday February 04, 2024 @03:23PM (#39254032)

There's also Cloud Hypervisor, which is very similar, and based off some of the same crosvm code and ideas.

https://github.com/cloud-hypervisor/cloud-hypervisor

[ Parent | on HN ]

Re:Leaky Vessels flaws allow hackers to escape Docker, runc ... by westurner on Sunday February 04, 2024 @07:14PM (#39255908)

gvisor; `runsc`: https://gvisor.dev/docs/ :

> gVisor provides a virtualized environment in order to sandbox containers. The system interfaces normally implemented by the host kernel are moved into a distinct, per-sandbox application kernel in order to minimize the risk of a container escape exploit. gVisor does not introduce large fixed overheads however, and still retains a process-like model with respect to resource utilization.

https://news.ycombinator.com/item?id=38609105

kata containers: https://github.com/kata-containers :

> Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs.

[ Parent | on HN ]