Are any container solutions secure enough to run fully un-trusted code, particularly as a VPS service?

Question

A number of answers here on this Stack Exchange argue that containers are inherently insecure and one should never run untrusted code in a container, let alone run a container built entirely by someone else.

And yet, there are a number of companies currently offering AWS-style VPS services that use containers instead of virtualization.

Of course, unless you run your own private datacenter with armed guards and don't connect it to the internet, no VPS or rented server is perfectly secure. For containers to be relevant, the possibility of attack doesn't need to be zero, it just needs to be sufficiently small compared to the attack vectors of alternative services.

So the question is: just how safe can containers be? Are there container systems (if so, which ones) which have no known exploits currently, and for which exploits are likely to be fairly hard to craft?

And one specific aspect of the question: At worst, is there any container system in which running an untrusted container can be considered as safe as running un-containerized code as an unprivileged user?

Answer 1

It's quite difficult to discuss containerization security in isolation as essentially the isolation features provided are functions of the Linux kernel (assuming we're talking here about projects like LXD, Docker and Rkt).

It's fair to say that an application in a container on a host is not likely to be less secure than the same application running on outside the container on the same host.

I'd suggest that a well configured container can add considerable security to the overall solution when compared to uncontained processes.

Features such as Linux namespaces, cgroups, capabilities, syscall filtering and Mandatory access control systems (such as AppArmor or SELinux) can all be utilized to help secure processes running in a container.

In a lot of cases it depends on how much effort the operator is willing to put into configuring the container security. The defaults of these projects tend to favour ensuring that most apps will work seemlessly rather than focusing on absolute security, so there's quite a bit of scope for hardening to be done.