Comment by l23k4 2 months ago Using containers as a security boundary is inexcusable. 5 comments l23k4 Reply overfeed 2 months ago That entirely depends on one's threat-model. Also, containerization is 100x better than rawdogging. l23k4 2 months ago > That entirely depends on one's threat-modelI think not, virtualization has such low overhead now that there's just no excuse. It's generally trivial to switch from containers to VMs. koolala 2 months ago It is excusable if all you care about is blocking sudo access while letting the ai use a pseudo sudo. rafterydj 2 months ago Could you elaborate on this? l23k4 2 months ago The cost-benefit ratio of using VMs over containers is very high. You trade negligible overhead for an actual security boundary.Containers don't provide good isolation and tend to be trivial to break out of.
overfeed 2 months ago That entirely depends on one's threat-model. Also, containerization is 100x better than rawdogging. l23k4 2 months ago > That entirely depends on one's threat-modelI think not, virtualization has such low overhead now that there's just no excuse. It's generally trivial to switch from containers to VMs.
l23k4 2 months ago > That entirely depends on one's threat-modelI think not, virtualization has such low overhead now that there's just no excuse. It's generally trivial to switch from containers to VMs.
koolala 2 months ago It is excusable if all you care about is blocking sudo access while letting the ai use a pseudo sudo.
rafterydj 2 months ago Could you elaborate on this? l23k4 2 months ago The cost-benefit ratio of using VMs over containers is very high. You trade negligible overhead for an actual security boundary.Containers don't provide good isolation and tend to be trivial to break out of.
l23k4 2 months ago The cost-benefit ratio of using VMs over containers is very high. You trade negligible overhead for an actual security boundary.Containers don't provide good isolation and tend to be trivial to break out of.
That entirely depends on one's threat-model. Also, containerization is 100x better than rawdogging.
> That entirely depends on one's threat-model
I think not, virtualization has such low overhead now that there's just no excuse. It's generally trivial to switch from containers to VMs.
It is excusable if all you care about is blocking sudo access while letting the ai use a pseudo sudo.
Could you elaborate on this?
The cost-benefit ratio of using VMs over containers is very high. You trade negligible overhead for an actual security boundary.
Containers don't provide good isolation and tend to be trivial to break out of.