I was wondering if it is secure or not to run containers from different customers on the same machine. Basically I was investigating the level of isolation / security provided by Docker alone.

Then I found Google Cloud Run, and I was wondering which one of the following is true:

  • Does it relies only on Docker isolation and runs the containers of different customers on the same nodes? In this case, the answer to my original question would be "yes, Docker container isolation is high, even Google relies on that"
  • Does it run Docker containers inside VM (created with KVM) and each VM is dedicated only to one specific customer? In this case, the answer to my original question would be "no", but I would have also additional doubts (i.e. how does Google instantly creates/destroys an entire VM, for each single request... this seems an impossible job).

I think that the same question can be also applied to other server-less solutions like AWS Lambda.


Google cloud run makes use of gvisor (info here), to provide it's container sandbox.

AWS Lambda makes use of firecracker (info here) for it's sandbox.

Whilst Docker with runc containers provides a reasonable level of isolation for many workloads (and can be further hardened from its default settings) both Google and Amazon are operating with arbitrary possibly malicious code and a threat model that includes high end attackers, so it makes sense for them to look at options which may provide a smaller attack surface and higher level of isolation than standard Linux containers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.