On macOS, Apple’s container tool is a much better option…

On macOS, Apple’s container tool is a much better option. Pretty much a drop-in replacement but it runs one VM per container so bug related to the kernel’s handling of namespaces or whatever are not container escapes. The only things in the VM that are not part of the container are still part of the container’s security context and it’s fine to assume that a compromise of the container can take control of them.
It’s roughly the same security model that big cloud providers use for containers because the VM boundary is much simpler, less stateful, and much easier to defend than something inside a kernel that is tens of millions of lines of C.
https://lobste.rs/c/khnaqk

Lobsters: Newest Comments