
Docker and Security - mwcampbell
http://blog.docker.io/2014/02/docker-and-security/
======
kogir
Containers are great for isolating trusted applications from one another to
ease deployment, but using them for multi-tenant security is ill advised.

Since all containers share the same kernel, any local privilege escalation
vulnerability in Linux can be used to escape the container. Such
vulnerabilities are much more common than vulnerabilities in mature
hypervisors, so virtualization is the safer choice.

~~~
tptacek
This, and also bear in mind that kernel crypto state, particularly for the
RNG, is shared.

~~~
sneak
Oh, fuck. I hadn't even _thought_ of that. That's disaster.

~~~
SvenDowideit
only if you're expecting containers to somehow be a unicorn that lets you give
people you don't know have your root password. :)

------
aroch
So, does Docker run their blog in its own docker container? If so, it crashed!

~~~
jamtur01
Oops. Looks like a little hiccup but we're back.

------
voltagex_
Was this written in response to an irresponsible disclosure?

~~~
jamtur01
Hi

We didn't have an irresponsible disclosure. We did recently present some of
this information and were asked about our security policy. That policy wasn't
yet published or announced so we decided it was important to get it out there,
especially leading up to the Docker 1.0 release.

Please feel free to contact me, james@docker.com, if you have any questions or
concerns about the policy.

Thanks!

~~~
voltagex_
Hm, maybe my comment sounded more harsh than I meant it to - I was more
curious because I've seen similar statements from other companies after
something bad had happened. Thanks for clarifying.

------
kbar13
502 Bad Gateway _

