In a comment over at !selfhosted@lemmy.world someone wrote:

Containers are not a security barrier. They cannot be, they never will be.

I’m no expert but my mental model of containers was different in that I thought containerized processes live in somehow separate environments, at least filesystem- and network-wise.

I run self-hosted services in containers on my server to isolate them from each other, and now and then binaries I don’t fully trust (things like suspected slop code or not well known python libraries) in containers on my laptop.

Does someone with more technical knowledge about how containers work feel like explaining whether that is a bad idea and if so why? That would be highly appreciated.

Edit: missing words and punctuation.

Edit 2: I would like to thank everyone who took the time to reply. My key take aways are that I will move my self-hosted services into VMs for proper isolation, but that it’s probably fine to use a container when I want to make sure an LLM doesn’t accidentally rm -rf my laptop system when it gets stuck.

  • Guiorgy@lemmy.ml
    7·
    2 days ago

    If you asked me 2 years ago, I’d say they give a decent level of isolation for cheap, but, at the end of the day, in the eyes of the kernel, containerized processes are just another process running on the same host, just with a different set of privileges. If you have public facing services, or untrusted binaries, I suggest moving those to VMs, local services can stay in containers. This is what I did after Copy Fail and Dirty Frag were discovered. Alpine Linux VMs are pretty lean, so I went with that, and to keep the migration simple, I run the services as containers inside the VMs.

    • robber@lemmy.mlOP
      3·
      1 day ago

      Thanks for your reply. A practical follow up: do you mount storage from the host or do you use virtual drives?

      I use ZFS on my host and and file recovery is just so convenient when the services can write directly to it. I’m reluctant to give that up but assume a mount reduces isolation.

      • Guiorgy@lemmy.ml
        2·
        1 day ago

        None of my VM require sharing of data, so each gets their own. I don’t currently use ZFS in Proxmox, but do have snapshots and periodic backups to my NAS, so recovery is generally not an issue.

        Conceptually, mounting a host storage inside a VM requires the use of either virtiofsd or NFS daemon running on the host (depending whether you mount it as local or network storage), so if either of the two or the underlying filesystem has a vulnerability, it does in theory create an attack surface, which is not ideal. With that said, as I mentioned above, I have not research led this enough, since I haven’t had the need yet, so don’t quote me on that. At the end of the day, it’s all about where you personally draw the line, so if you are fine with that risk and absolutely can’t give up the feature than go for it, it’s your system.