News for hackers. Stuff that matters.

A comment on Building a Linux Container Runtime from Scratch. Parent comment

Re:Building a Linux Container Runtime from Scratch by vaylian on Thursday March 27, 2025 @03:03PM (#43496906)
> There are many container escapes each year because the chunk of api that they are required to cover is so large

What API? The kernel syscall API?

If we assume for a moment, that there are no bugs in the Linux namespace implementation, would containers be as safe as virtual machines?

[ Parent | on HN ]
Re:Building a Linux Container Runtime from Scratch by eyberg on Thursday March 27, 2025 @03:08PM (#43496973)
No. As I'm responding to this Qualys just announced three new bypasses as of today: https://seclists.org/oss-sec/2025/q1/253 .
[ Parent | on HN ]
Re:Building a Linux Container Runtime from Scratch by vaylian on Thursday March 27, 2025 @03:39PM (#43497274)
Sorry, can you elaborate? Your answer is not really clear. Why is it not possible for Linux namespaces to be secure?
[ Parent | on HN ]