I’ve read that standard containers are optimized for developer productivity and not security, which makes sense.

But then what would be ideal to use for security? Suppose I want to isolate environments from each other for security purposes, to run questionable programs or reduce attack surface. What are some secure solutions?

Something without the performance hit of VMs

  • dragnucs
    5·
    2 years ago

    This is a problem of the containerized program and the image itself. This problem affect, containers, VM, and baremetal aswel.

    • boo@beehaw.org
      2·
      2 years ago

      I agree. But imo these usecases are more known and mature in traditional setups, we could apt update and restart a systemd service and its done.

      Its not so obvious and there are no mechanisms for containers/images.

      (I am not into devops/sysadmin, so this might also be my lack of exposure)

      • dragnucs
        2·
        2 years ago

        Most often, images are updated automatically and are managed by the developers themselves so images are usually up to date. If you don’t know how to build images, it may be difficult for you to update the containerized software before the vendor does. But this situation is infrequent.

        • AggressivelyPassive@feddit.de
          1·
          2 years ago

          Many projects just pull in a bunch of images from wherever and never update them. Especially if it’s that one obscure image that happens to package this over obscure app you absolutely need.