I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
Specially, can an attacker escape from the container or manipulate the host?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Systemd-nspawn only manages isolated processes. It cannot isolate resources (which systemd can).
As a constructive difference, in the case of namespaces, you start with no isolation and you add whatever you require — mounts, PIDs, networks, users, etc. In the case of jails, you start with a reasonable secure baseline since the processes, IPCs, mounts and users are always isolated. That does not mean you can't get to the same level of security.
We can create a fully isolated environment, which will automatically monitor the /proc and /sys pseudo-file systems and create an isolated loop-back interface and separate name space for PIDs. From there we can run what we want.
To limit the isolation problem we can use systemctl:
systemctl set-property CPUShares=80 CPUQuota=25% MemoryLimit=1024M
So to conclude, by default you don't have the same level of security but you can get to the same level. Nspawn will probably also evolve a lot more in the near future.