LWN: Comments on "Docker security in the future (Opensource.com)"

Docker security in the future (Opensource.com)

smitty_one_each — Thu, 26 Mar 2015 12:00:25 +0000

You make a requirement to sell more resources to the client sound like such a bad thing! ;-)

Docker security in the future (Opensource.com)

jhoblitt — Mon, 23 Mar 2015 16:26:03 +0000

It's likely still a performance win over hardware virtualization but the overhead of a "secure" container setup (selinux + seccomp + uid translation + network proxy containers) is starting to sound non-trivial.

Docker security in the future (Opensource.com)

justincormack — Sun, 22 Mar 2015 17:30:49 +0000

Filtering 17 odd syscalls and some network protocols is going to help a little, but seccomp policies work best if they are mostly deny, and of course that is rather difficult in the situation where you are trying to contain generic applications that you know little about.