How separate containers really are.
WHAT ISOLATES THEM
Namespaces, controlling what a process can see Control groups, controlling what it can consume Capabilities, limiting privileged operations Filters restricting kernel calls
WHAT IS SHARED
The kernel.
WHAT THAT MEANS
A kernel vulnerability can cross the boundary.
WHY THAT MATTERS
Containers are not a security boundary between untrusted parties.
WHAT TO USE WHERE THAT IS REQUIRED
Virtual machines, or a runtime providing one per container.
WHAT WEAKENS ISOLATION FURTHER
Running as root inside the container Privileged mode Mounting the host filesystem Mounting the engine's socket Sharing the host's network or process namespace
WHY THE ENGINE SOCKET IS THE WORST
A container with it can start another container mounting the whole host.
WHAT THAT AMOUNTS TO
Root on the host.
WHAT TO NEVER DO
Mount that socket into a container you do not fully trust.
WHAT TO USE INSTEAD
A proxy restricting which operations are permitted.
WHAT TO SET ON EVERY CONTAINER
A non-root user Dropped capabilities No privilege escalation A read-only filesystem, where possible
WHAT TO REVIEW
Anything running privileged, and why.
