virtual-machine - 像 docker 一样使用 linux 容器 (lxc) 是否安全？

Question

如果我允许用​​户运行他想要的任何东西，他是否能够对在哪个容器中执行的 env 做坏事？

Answer 1

据我所知，答案是肯定的。所以你可能不应该在任何容器上给黑客 sudo 权限......

一个快速的谷歌搜索给了我以下内容。

在 https://wiki.ubuntu.com/LxcSecurity 上:

... containers will always (by design) share the same kernel as the host. Therefore, any vulnerabilities in the kernel interface, unless the container is forbidden the use of that interface (i.e. using seccomp2) can be exploited by the container to harm the host.

上 http://www.funtoo.org/wiki/Linux_Containers

As of Linux kernel 3.1.5, LXC is usable for isolating your own private workloads from one another. It is not yet ready to isolate potentially malicious users from one another or the host system.

他们建议 OpenVZ 作为替代方案。