Re:Python on the Edge: Fast, sandboxed, and powered by WebAs...
by Scramblejams on Thursday September 25, 2025 @01:45PM
(#45376239)
Better not rely on unprivileged containers to save you. The problem is:
Breaking out of a VM requires a hypervisor vulnerability, which are rare.
Breaking out of a shared-kernel container requires a kernel syscall vulnerability, which are common. The syscall attack surface is huge, and much of it is exploitable even by unprivileged processes.
I posted this thread elsewhere here, but for more info: https://news.ycombinator.com/item?id=32319067
Like it's also possible in a VM.
What about running non privileged containers! You need really to open some doors to make it easier!