In a comment over at !selfhosted@lemmy.world someone wrote:

Containers are not a security barrier. They cannot be, they never will be.

I’m no expert but my mental model of containers was different in that I thought containerized processes live in somehow separate environments, at least filesystem- and network-wise.

I run self-hosted services in containers on my server to isolate them from each other, and now and then binaries I don’t fully trust (things like suspected slop code or not well known python libraries) in containers on my laptop.

Does someone with more technical knowledge about how containers work feel like explaining whether that is a bad idea and if so why? That would be highly appreciated.

Edit: missing words and punctuation.

  • MonkderVierte@lemmy.zip
    11·
    12 hours ago

    Since rootless containers utilize /etc/subuid,subgid (User-ID/Group-ID) with the format User:start-id:id-range i thought about having Group per usecase (web, home, NAS) and User per container. This separates them on OS-level and makes it easy to manage via nftables. Good idea?