In a comment over at !selfhosted@lemmy.world someone wrote:
Containers are not a security barrier. They cannot be, they never will be.
I’m no expert but my mental model of containers was different in that I thought containerized processes live in somehow separate environments, at least filesystem- and network-wise.
I run self-hosted services in containers on my server to isolate them from each other, and now and then binaries I don’t fully trust (things like suspected slop code or not well known python libraries) in containers on my laptop.
Does someone with more technical knowledge about how containers work feel like explaining whether that is a bad idea and if so why? That would be highly appreciated.
Edit: missing words and punctuation.
If you asked me 2 years ago, I’d say they give a decent level of isolation for cheap, but, at the end of the day, in the eyes of the kernel, containerized processes are just another process running on the same host, just with a different set of privileges. If you have public facing services, or untrusted binaries, I suggest moving those to VMs, local services can stay in containers. This is what I did after Copy Fail and Dirty Frag were discovered. Alpine Linux VMs are pretty lean, so I went with that, and to keep the migration simple, I run the services as containers inside the VMs.