I’ve read that standard containers are optimized for developer productivity and not security, which makes sense.

But then what would be ideal to use for security? Suppose I want to isolate environments from each other for security purposes, to run questionable programs or reduce attack surface. What are some secure solutions?

Something without the performance hit of VMs

  • dragnucs
    link
    fedilink
    arrow-up
    5
    ·
    1 year ago

    This is a problem of the containerized program and the image itself. This problem affect, containers, VM, and baremetal aswel.

    • boo@beehaw.org
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      I agree. But imo these usecases are more known and mature in traditional setups, we could apt update and restart a systemd service and its done.

      Its not so obvious and there are no mechanisms for containers/images.

      (I am not into devops/sysadmin, so this might also be my lack of exposure)

      • dragnucs
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        Most often, images are updated automatically and are managed by the developers themselves so images are usually up to date. If you don’t know how to build images, it may be difficult for you to update the containerized software before the vendor does. But this situation is infrequent.

        • AggressivelyPassive@feddit.de
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          Many projects just pull in a bunch of images from wherever and never update them. Especially if it’s that one obscure image that happens to package this over obscure app you absolutely need.