In a comment over at [email protected] someone wrote:
Containers are not a security barrier. They cannot be, they never will be.
I’m no expert but my mental model of containers was different in that I thought containerized processes live in somehow separate environments, at least filesystem- and network-wise.
I run self-hosted services in containers on my server to isolate them from each other, and now and then binaries I don’t fully trust (things like suspected slop code or not well known python libraries) in containers on my laptop.
Does someone with more technical knowledge about how containers work feel like explaining whether that is a bad idea and if so why? That would be highly appreciated.
Edit: missing words and punctuation.
There are way too many ways for things to potentially escape from a container and start interacting with the parent os. These can vary from simple misconfiguration (they’re not secure for this out of the box, and there are aspects of this that are easy to get wrong) to unknown kernel vulnerabilities that can’t reasonably be defended against.
As someone else said, use virtual machines if you’re really concerned.