One of my Drupal sites was hacked

Re:One of my Drupal sites was hacked by porker on Wednesday April 30, 2014 @11:46AM (#7674068)

I am definitely going to reinvestigate putting every user's data in their own container. When I last looked the options were FreeBSD Jails (not appealing) or Solaris Zones (interesting but a whole new OS); now with LXC maybe that can assist? There must be a way to harden things further...

[ Parent | on HN ]

Re:One of my Drupal sites was hacked by Nick_C on Friday May 02, 2014 @05:27AM (#7684745)

FreeBSD's jails have had a lot of work done on them over the last couple of versions. Now that 10.0 is out, could be worth another look.

[ Parent | on HN ]

Re:One of my Drupal sites was hacked by jafaku on Wednesday April 30, 2014 @01:17PM (#7674719)

Why not Docker? (lxc)

[ Parent | on HN ]

Re:One of my Drupal sites was hacked by peterwwillis on Wednesday April 30, 2014 @02:11PM (#7675142)

Docker is not designed to isolate the root user from the rest of your system, and containers/capabilities are not MAC-based security. Docker strips 16 capabilities when it runs a container, leaving 23 additional capabilities to be abused by root, and whatever other vulnerabilities are left that capabilities don't cover. To prevent this you need guest isolation via virtualization.

https://wiki.ubuntu.com/LxcSecurity http://www.infoq.com/news/2013/09/docker-container-security http://s3hh.wordpress.com/2013/07/19/creating-and-using-cont...

[ Parent | on HN ]