JLD

I should have just said that containers are, at the very least, a component in security. There’s this running argument that containers are not meant for security, but if we actually go back to jails in FreeBSD that’s not really the case, so we are in agreement. Isolation is their original goal. And I would argue that isolation is definitely a tool for security.

It’s true that containers were built for reproducibility rather than security, but it’s also true that they can be a helpful tool in securing an environment. Not the ONLY tool, but a helpful one, as they implement kernel namespaces, and, also, tools like podman give you easy access to seccomp-bpf as well. I’ve personally used containers as part of a sandbox for an AI agent, but I integrated quite a lot of security components apart from the container itself, including proper firewall rules on the host level, a landlock ruleset inside the container, a custom seccomp-bpf profile, DNS allowlisting to avoid DNS data exfiltration, and, of course, basic container hardening stuff, like setting the filesystem to read-only, or setting proper uid/gid mapping. There’s a lot you can do with it, but simply containerizing an application won’t secure it by default.

They know they’re at risk of losing their market share with Windows, so they’re pivoting to Linux. They don’t get that they’re the virus!