News for hackers. Stuff that matters.

A comment on RancherOS: An OS for Docker Containers. Parent comment

Re:RancherOS: An OS for Docker Containers by lclarkmichalek on Wednesday February 25, 2015 @06:51AM (#9106295)
A hypervisor is the best defense you can have against running code so close to root
[ Parent | on HN ]
Re:RancherOS: An OS for Docker Containers by mrmondo on Wednesday February 25, 2015 @07:56AM (#9106476)
It's not quite that simple, an insecure or vulnerable hypervisor can actually make it easier to exploit a system. (Note: I'm not suggesting that running Docker as PID1 or similar is a good idea)
[ Parent | on HN ]
Re:RancherOS: An OS for Docker Containers by lclarkmichalek on Wednesday February 25, 2015 @08:55AM (#9106711)
I think it's fair to say that it's easier to secure a hypervisor than it is to secure a Docker daemon. Lord knows we've had a lot more experience securing hypervisors.
[ Parent | on HN ]