In a comment over at [email protected] someone wrote:

Containers are not a security barrier. They cannot be, they never will be.

I’m no expert but my mental model of containers was different in that I thought containerized processes live in somehow separate environments, at least filesystem- and network-wise.

I run self-hosted services in containers on my server to isolate them from each other, and now and then binaries I don’t fully trust (things like suspected slop code or not well known python libraries) in containers on my laptop.

Does someone with more technical knowledge about how containers work feel like explaining whether that is a bad idea and if so why? That would be highly appreciated.

Edit: missing words and punctuation.

  • corsicanguppy@lemmy.caEnglish
    1·
    3 hours ago
    1. Containerization is not a security improvement, since it strongly depends on the sandboxing (and the trends are terrible for that)
    2. Containerization frustrates validation of the installed state of the system. This means you can’t answer “how do you know” when you need to.
    3. Containerization adds a layer of unnecessary tech. I’m not saying it’s a bad thing, just something you don’t need.

    I say this as a former OS security guy for Unix and Linux – like, as a job, working for a very well-known global vendor.