Obviously the author put a lot of effort into this paper. Hard work shows throughout. Kudos to you sir!<p>Granted I realize the title is "Understanding and Hardening <i>Linux</i> Containers".<p>However, personally, this just illustrates my frustration and the frustration of others with the Linux world.<p>They exist in their own little echo chamber. Linux was not the first to create "containers" that are secure. There is no inclusion of other solutions outside Linux.<p>The reason other solutions do not have these problems is because the authors actually thought about the problem. And if the Linux camp would simply look outside their echo chamber long enough to see how others solved these problems before them this paper might not have been written.<p>It's just simply frustrating to watch Linux reinvent some wheels, poorly, time after time.<p>Flame on!
This..... this is the thing every architect attempting to roll containers out to production needs to read and re read<p>Complexity at scale:
Orchestration frameworks (Rancher, MESOS/Aurora, Docker Swarm, LXD, OpenStack Containers, Kubernetes/Borg, etc) are only recently catching up to the container craze, there are too many competing models to list. Many have questionable or unaudited security or leave major requirements out, such as secret management. While containers may be easy to get working within a workstation or a few servers, scaling them up to production deployment is another challenge altogether, even assuming your application stack can be properly ``containerized''
<i>"While Linux Container systems (LXC, Docker, CoreOS Rocket, etc) have undergone fast deployment and development, security knowledge has lagged behind. The number of people focused on container security...seems disproportionately small"</i><p>I agree with this part. Most containers aren't running as an unprivileged user. Those environments that do support it only support it in a very limited set of os/kernel/whatever versions. Somewhat concerning since containers are getting traction almost everywhere.
Has there been a writeup of the history of Container technology? How did these features find their way into the Linux kernel in the first place? What was the original motivation? (Sandboxing, I would guess.) Who were the stakeholders who pushed those features, and why?<p>It's weird and wonderful that such technology infrastructure arose and such innovation happens. I'm curious how.
The article contains the best explanation of Linux capabilities that I have seen.<p>Too bad that Docker and other container solutions defaults to rather broad set of capabilities requiring to use things like<p><pre><code> --cap-drop=ALL --cap-add=NET_BIND_SERVICE ...
</code></pre>
with typical container invocations to minimize a chance of container escape.