9 ms·

Containers are never a security boundary. If you configure them correctly, avoid all the footguns, and pray that there's no container escape vulnerabilities tha

Containers are never a security boundary. If you configure them correctly, avoid all the footguns, and pray that there's no container escape vulnerabilities that affect "correctly" configured containers then they can be a crude approximation of a security boundary that may be enough for your use case, but they aren't a suitable substitute for hardware backed virtualization. The only serious company that I'm aware of which doesn't understand that is Microsoft, and the reason I know that is because they've been embarrassed again and again by vulnerabilities that only exist because they run multitenant systems with only containers for isolation

vel0city 9mo ago
Virtual machines are never a security boundary. If you configure them correctly, avoid all the footguns, and pray that there's no VM escape vulnerabilities that affect "correctly" configured VMs then they can be a crude approximation of a security boundary that may be enough for your use case, but they aren't a suitable substitute for entirely separate hardware. Its all turtles, all the way down.
- flaminHotSpeedo 9mo ago
  Yeah, in some (rare) situations physical isolation is a more appropriate level of security. Or if you want to land somewhere in between, you can use VM's with single tenant NUMA nodes. But for a typical case, VM's are the bare minimum to say you have a _secure_ isolation boundary because the attack surface is way smaller.
  - vel0city 9mo ago
    Yeah, so secure. https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 https://support.broadcom.com/web/ecx/support-content-notific... https://nvd.nist.gov/vuln/detail/CVE-2019-5183 https://nvd.nist.gov/vuln/detail/CVE-2019-5183 https://nvd.nist.gov/vuln/detail/CVE-2018-12130 https://nvd.nist.gov/vuln/detail/CVE-2018-12130 https://nvd.nist.gov/vuln/detail/CVE-2018-2698 https://nvd.nist.gov/vuln/detail/CVE-2018-2698 https://nvd.nist.gov/vuln/detail/CVE-2017-4936 https://nvd.nist.gov/vuln/detail/CVE-2017-4936 In the end you need to configure it properly and pray there's no escape vulnerabilities. The same standard you applied to containers to say they're definitely never a security boundary. Seems like you're drawing some pretty arbitrary lines here.

vel0city 9mo ago

Virtual machines are never a security boundary. If you configure them correctly, avoid all the footguns, and pray that there's no VM escape vulnerabilities that affect "correctly" configured VMs then they can be a crude approximation of a security boundary that may be enough for your use case, but they aren't a suitable substitute for entirely separate hardware. Its all turtles, all the way down.

flaminHotSpeedo 9mo ago
Yeah, in some (rare) situations physical isolation is a more appropriate level of security. Or if you want to land somewhere in between, you can use VM's with single tenant NUMA nodes. But for a typical case, VM's are the bare minimum to say you have a _secure_ isolation boundary because the attack surface is way smaller.
- vel0city 9mo ago
  Yeah, so secure. https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 https://support.broadcom.com/web/ecx/support-content-notific... https://nvd.nist.gov/vuln/detail/CVE-2019-5183 https://nvd.nist.gov/vuln/detail/CVE-2019-5183 https://nvd.nist.gov/vuln/detail/CVE-2018-12130 https://nvd.nist.gov/vuln/detail/CVE-2018-12130 https://nvd.nist.gov/vuln/detail/CVE-2018-2698 https://nvd.nist.gov/vuln/detail/CVE-2018-2698 https://nvd.nist.gov/vuln/detail/CVE-2017-4936 https://nvd.nist.gov/vuln/detail/CVE-2017-4936 In the end you need to configure it properly and pray there's no escape vulnerabilities. The same standard you applied to containers to say they're definitely never a security boundary. Seems like you're drawing some pretty arbitrary lines here.