Comment

Comment on Does running applications inside a container as an unprivileged user have any security benefits?

Container are not a security concept. Hence, running things inside of a container does not provide any security benefits as opposed to outside of the container.

In actual fact, if you take the time to configure you services with proper systemd security features, you get more secure environments than with running generic containers with “just” unprivileged users.

source

Sort:hotnew top

sudneo@lemmy.world ⁨1⁩ ⁨year⁩ ago
Not really true, containers are based on namespaces which have always been also a security feature. Chroot has been a common “system” technique, afterall.

Containers help security if built properly, and it’s easier to build a container securely (and run them), compared to proper SystemD unit security.

source
- ck_@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago
  
  containers are based on namespaces which have always been also a security feature.
  
  Not correct.
  
  Chroot has been a common “system” technique, afterall.
  
  Not correct.
  
  source
  - sudneo@lemmy.world ⁨1⁩ ⁨year⁩ ago
    OK :)
    
    So chroot has not been used to isolate processes for decades to a confined view of the filesystem (especially in combo with a restricted shell), and for example the networking namespace is not used to limit the impact on a compromise on the firewall, the user namespace is not used to allow privileged processes to run de-facto unprivileged.
    
    Whatever you say
    
    source
  - wreckedcarzz@lemmy.world ⁨1⁩ ⁨year⁩ ago
    [citation needed]
    
    source