In a comment over at !selfhosted@lemmy.world someone wrote:
Containers are not a security barrier. They cannot be, they never will be.
I’m no expert but my mental model of containers was different in that I thought containerized processes live in somehow separate environments, at least filesystem- and network-wise.
I run self-hosted services in containers on my server to isolate them from each other, and now and then binaries I don’t fully trust (things like suspected slop code or not well known python libraries) in containers on my laptop.
Does someone with more technical knowledge about how containers work feel like explaining whether that is a bad idea and if so why? That would be highly appreciated.
Edit: missing words and punctuation.
Blindly trusting anything as a security barrier is a bad idea. That being said, there is a growing view among security professionals that containers are not sufficient protection against malicious code because it can directly attack the host kernel. This is not a new problem which is why most, if not all commercial container hosts have always used virtual machines to isolate containers from their bare metal systems.