5 ms·
Because the guests have their own SELinux policies. Docker containers don't come with policies, but if it would support running containers under a user account
by brokenparser 13y ago
Because the guests have their own SELinux policies. Docker containers don't come with policies, but if it would support running containers under a user account I could at least restrict each to their own category so that theoretically a chmod -R 777 / (inside a container) and access to the host wouldn't compromise other containers (unless the kernel is exploitable, in which case KVM would still win).
- nickstinemates 13y agoMaybe we're talking past each other here, but, Dan Walsh, author of SELinux, is working to bring SELinux natively to libcontainer / docker. I'd love to talk more about your needs and how we can help. My email is always open - nick@docker.com