In a comment over at !selfhosted@lemmy.world someone wrote:

Containers are not a security barrier. They cannot be, they never will be.

I’m no expert but my mental model of containers was different in that I thought containerized processes live in somehow separate environments, at least filesystem- and network-wise.

I run self-hosted services in containers on my server to isolate them from each other, and now and then binaries I don’t fully trust (things like suspected slop code or not well known python libraries) in containers on my laptop.

Does someone with more technical knowledge about how containers work feel like explaining whether that is a bad idea and if so why? That would be highly appreciated.

Edit: missing words and punctuation.

  • tirateimas@lemmy.pt
    12·
    14 hours ago

    Depends on your threat model.

    Containers are good, but they don’t offer perfect security. Recently we have seen that even VMs can’t ensure complete security.

    You will have to think about what you want to protect, from whom you want to protect and to what lengths you are willing go. Then find a good compromise.