Comment on Does running applications inside a container as an unprivileged user have any security benefits?
x1gma@lemmy.world 10 months ago
Imagine your containers as very lightweight mini-VMs. Would you run everything as root in your virtual machines? Containers aren’t really that different to classical VMs from an operations point of view. You have a different attack surface, but it is still there, and running as a non-root user inside the container reduces this attack surface, and should IMHO be the default. Privileged containers and users may be required for specific purposes, but should not be the norm, if possible.
ck_@discuss.tchncs.de 10 months ago
This comment shows misunderstanding of what container and virtual machines are and how the technology behind each concept works. Containers are NOT virtual machines, do not treat them as such.
x1gma@lemmy.world 10 months ago
You’re right, containers are not VMs, and I’ve never claimed that. For the matter of basic unix access control for a beginner they are similar enough to treat them as such. It’s enough of a baseline for basic security for a beginners workload imo. For advanced use cases - absolutely do not treat containers as you would VMs.