8

This question already has an answer here:

Does Docker provide the same level of security/isolation as a virtual machine running over a hypervisor? If not, how can that be achieved?

marked as duplicate by Arminius, Rory Alsop Sep 18 '17 at 23:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

10

Theoretically, the isolation of Docker is not quite as strong, because parts of the system are shared (kernel is shared, container has a chroot of the original filesystem, etc). However, for most purposes it's good enough. With chroot, cgroups, etc, and the ability to run containers under an unprivileged account (so root in the container is still limited on the host), you can lock down the container sufficiently for most uses.

If you really want VM-level isolation, then use a VM. Depending on the use case, you could start and stop Docker containers within a VM.

1

No, Docker is less secure by design, check out the answer on https://security.stackexchange.com/a/148794/39716

OS-level virtualization reuses the kernel-space between virtual machines, and kernel is a much more complicated piece of code, leaving a MUCH larger attack surface - basically the same thing that makes docker super-nice to stack a bunch of VMs with limited resources in a tiny bit of memory is what makes it less useful for the PCI DSS use case - kernel reuse.

Not the answer you're looking for? Browse other questions tagged or ask your own question.