I’ve read that standard containers are optimized for developer productivity and not security, which makes sense.

But then what would be ideal to use for security? Suppose I want to isolate environments from each other for security purposes, to run questionable programs or reduce attack surface. What are some secure solutions?

Something without the performance hit of VMs

  • boo@beehaw.org
    link
    fedilink
    arrow-up
    3
    ·
    1 year ago

    There can also be old images with e.g. old openssl versions being used. Its not a concern if they are updated frequently, but still manual.

    • dragnucs@lemmy.ml
      link
      fedilink
      arrow-up
      5
      ·
      1 year ago

      This is a problem of the containerized program and the image itself. This problem affect, containers, VM, and baremetal aswel.

      • boo@beehaw.org
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        I agree. But imo these usecases are more known and mature in traditional setups, we could apt update and restart a systemd service and its done.

        Its not so obvious and there are no mechanisms for containers/images.

        (I am not into devops/sysadmin, so this might also be my lack of exposure)

        • dragnucs@lemmy.ml
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          Most often, images are updated automatically and are managed by the developers themselves so images are usually up to date. If you don’t know how to build images, it may be difficult for you to update the containerized software before the vendor does. But this situation is infrequent.

          • AggressivelyPassive@feddit.de
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            Many projects just pull in a bunch of images from wherever and never update them. Especially if it’s that one obscure image that happens to package this over obscure app you absolutely need.