⚠️ Just a reminder, folks:
The "container" movement on Linux emerged as a convenient way to manage different, possibly conflicting settings & dependencies for different apps on a machine. "Security" by sandboxing got tacked on later, and the quality of that isolation remains LOW regardless of all the trendy project names and acronyms that have filled that space.
Data centers' standard for high security consists of virtual machines (type 1 hypervisors) or separate dedicated hardware. Ain't no way, no how is a successful datacenter going to ask a giant, complex, contorted Linux or BSD (or hybrid Windows or Mac) kernel for sandboxing services to contain threats.
If you are using containers to enhance security – on any general-purpose machine – make sure they are running as VMs, or as sandboxes on a microkernel (not monolithic) architecture.
#infosec #security #containers #hypervisors #microkernel
