Comments on: Three Things to Consider When Thinking About Containers https://www.percona.com/blog/three-things-consider-thinking-containers/ Tue, 06 Aug 2019 20:38:34 +0000 hourly 1 https://wordpress.org/?v=6.5.2 By: Jon Tobin https://www.percona.com/blog/three-things-consider-thinking-containers/#comment-10967234 Mon, 24 Oct 2016 14:35:18 +0000 https://www.percona.com/blog/?p=38845#comment-10967234 Darrell,
You make a valid point about the ability for your configuration to limit access to your containers. It’s obvious that you have a high degree of expertise in systems and that can help make containers more secure. Please don’t misunderstand my intentions here. It is not to discourage anyone from the use of containers, but to have an honest discussion about it. To that point, thank you for taking the time to leave a thoughtful comment! This type of discourse makes us all better.

Now, let me make a simple point about my perspective on the topic. Everything you’ve said is also true of VMs, and in most cases, doubly true. Furthermore, the main reason for my high level recommendation on VMs for security is the amount of DEFAULT isolation bare-metal virtualization provides; to quote the ITWorld article from below “containers do not contain.” If used in the same manner as containers, then there would be a much, much lower attack surface (like for like). Furthermore, the need perform a high level of customization and configuration to get a secure container only increases the likelihood that a mistake will be made. Based on the conversations I’ve had with Executives, this is a paramount concern. Efficiency is great, but security is mandatory.

All this being said, if someone would like to learn more about the subject, here are a few good articles:
ITWorld Article: http://bit.ly/2f8VvTO
InfoWorld: http://bit.ly/2f8S3IS

]]> By: Darrell Breeden https://www.percona.com/blog/three-things-consider-thinking-containers/#comment-10967222 Fri, 21 Oct 2016 22:00:50 +0000 https://www.percona.com/blog/?p=38845#comment-10967222 I think you’re over simplifying the concept of security in containers for the sake of this argument. Docker can be secured via TLS such that clients require a valid certificate to even access it. If you do that and disable socket level access, the only way to access the swarm cluster or host would be via a valid, signed certificate.

Also, there are way more pros when it comes to security from containerization dealing with segregated networks, not having to expose ports for services due to container links and more. CGroups can also be defined to mitigate noisy neighbor syndrome.

On top of that, most patches or security flaws could be fixed by simply rebuilding your image since they’ll normally include package update and install operations. I want to make sure people have all the information available on this subject before some upper level exec decides not to use containers since they saw that “VMs are better for security” on a post somewhere.

]]>