Re:RancherOS: An OS for Docker Containers
by mrmondo on Tuesday February 24, 2015 @11:28PM
(#9105296)
Is SELinux or GRSecurity built in and enabled?
[ Parent
| on HN ]
Re:RancherOS: An OS for Docker Containers
by lclarkmichalek on Wednesday February 25, 2015 @05:22AM
(#9106111)
Highly unlikely, given this is a product coming out of the Docker ecosystem.
Re:RancherOS: An OS for Docker Containers
by mrmondo on Wednesday February 25, 2015 @05:43AM
(#9106155)
We run SELinux on all our docker hosts and are about to roll out GRSecurty as well, at present this is one of the best lines of defence you have against running code so close to root.
Re:RancherOS: An OS for Docker Containers
by lclarkmichalek on Wednesday February 25, 2015 @06:51AM
(#9106295)
A hypervisor is the best defense you can have against running code so close to root
Re:RancherOS: An OS for Docker Containers
by mrmondo on Wednesday February 25, 2015 @07:56AM
(#9106476)
It's not quite that simple, an insecure or vulnerable hypervisor can actually make it easier to exploit a system. (Note: I'm not suggesting that running Docker as PID1 or similar is a good idea)
Re:RancherOS: An OS for Docker Containers
by lclarkmichalek on Wednesday February 25, 2015 @08:55AM
(#9106711)
I think it's fair to say that it's easier to secure a hypervisor than it is to secure a Docker daemon. Lord knows we've had a lot more experience securing hypervisors.