Many people think of containers as compact virtual machines. That misconception leads to poor security decisions. In reality, a container is just a regular Linux process running directly on the host’s kernel.
The three mechanisms that make up a container
- Namespace — determines what a process sees. The PID namespace makes the process think it is process number 1; the network namespace gives it its own network stack; the mount namespace gives it its own directory tree
- cgroup — determines how much CPU, RAM, and disk bandwidth a process can use
- Layered file system — multiple containers share read-only layers, and each has its own write layer, so creating a new container is nearly instantaneous
Security Implications
Because they share the same kernel, a privilege escalation vulnerability in the kernel could allow an attacker to escape from the container and gain direct access to the host machine. Virtual machines have an additional isolation layer provided by the virtualization software.
From this, we can derive a few practical principles:
- Don't run containers with root privileges unless absolutely necessary
- Don’t map Docker sockets to containers—that grants root privileges to the host
- To isolate multiple users who don’t trust each other, use virtual machines; don’t rely on containers
Why You Should Still Use It
Containers are excellent at solving the problems of packaging and environment replication: the same image runs identically on your machine and on the server. That is their main value; isolation is just an added bonus—and a limited one at that.
Thảo luận