Re:Happy Birthday Docker
by brokenparser on Thursday March 20, 2014 @04:33PM
(#7438516)
And without the security benefits of proper virtualisation, too. At least lxc since recently has the ability to run containers as a regular user, but I'll stick to KVM guests secured with MLS policies for now.
[ Parent
| on HN ]
Re:Happy Birthday Docker
by nickstinemates on Thursday March 20, 2014 @07:18PM
(#7439578)
Why not combine the two and get the value of both? And, a reminder, you can still use LXC with Docker. It's fully supported.
Re:Happy Birthday Docker
by brokenparser on Friday March 21, 2014 @06:58AM
(#7441560)
Because the guests have their own SELinux policies. Docker containers don't come with policies, but if it would support running containers under a user account I could at least restrict each to their own category so that theoretically a chmod -R 777 / (inside a container) and access to the host wouldn't compromise other containers (unless the kernel is exploitable, in which case KVM would still win).
Re:Happy Birthday Docker
by nickstinemates on Friday March 21, 2014 @02:06PM
(#7443731)
Maybe we're talking past each other here, but, Dan Walsh, author of SELinux, is working to bring SELinux natively to libcontainer / docker.
I'd love to talk more about your needs and how we can help. My email is always open - [email protected]