I was wondering if it is secure or not to run containers from different customers on the same machine. Basically I was investigating the level of isolation / security provided by Docker alone.
Then I found Google Cloud Run, and I was wondering which one of the following is true:
- Does it relies only on Docker isolation and runs the containers of different customers on the same nodes? In this case, the answer to my original question would be "yes, Docker container isolation is high, even Google relies on that"
- Does it run Docker containers inside VM (created with KVM) and each VM is dedicated only to one specific customer? In this case, the answer to my original question would be "no", but I would have also additional doubts (i.e. how does Google instantly creates/destroys an entire VM, for each single request... this seems an impossible job).
I think that the same question can be also applied to other server-less solutions like AWS Lambda.