Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container.

Reasoning behind that is that even if your containers run on user privileges, still containerd (unless it's running in rootless mode) runs as root so it can be easily exploited, whereas if you're running app on bare metal as non-root user you can get rid of most of deamons running as root so that apart from kernel and systemd nothing actually runs on Linux as root. Everything can be controlled using only sudo and capabilities.

While it seems to somewhat make sense it's really counter intuitive and sounds to me like over focusing only on one aspect of security but I'm struggling to counter this argument.

  • I'm actually researching this question as well, and don't know the answer. My intuition tells me that, for your specific scenario, you are basically choosing between risk of confidentiality verses risk of process take-over. Namely, with bare metal, the binary will be able to access everything the runner can access. On the other hand, with Docker, the risk is the binary being able to "escape" the container and become root. Arguably, the risk on the Docker side is lower. However, the impact and severity is significantly higher.
    – nehcsivart
    Commented Oct 29, 2021 at 4:12


You must log in to answer this question.

Browse other questions tagged .