5 ms·
And without the security benefits of proper virtualisation, too. At least lxc since recently has the ability to run containers as a regular user, but I'll stick
by brokenparser 13y ago
And without the security benefits of proper virtualisation, too. At least lxc since recently has the ability to run containers as a regular user, but I'll stick to KVM guests secured with MLS policies for now.
- nickstinemates 13y agoWhy not combine the two and get the value of both? And, a reminder, you can still use LXC with Docker. It's fully supported.
- brokenparser 13y agoBecause the guests have their own SELinux policies. Docker containers don't come with policies, but if it would support running containers under a user account I could at least restrict each to their own category so that theoretically a chmod -R 777 / (inside a container) and access to the host wouldn't compromise other containers (unless the kernel is exploitable, in which case KVM would still win).
- nickstinemates 13y agoMaybe we're talking past each other here, but, Dan Walsh, author of SELinux, is working to bring SELinux natively to libcontainer / docker. I'd love to talk more about your needs and how we can help. My email is always open - nick@docker.com