Skip to main content
Share Your Experience: Take the 2024 Developer Survey
460 votes
Accepted

Is Docker more secure than VMs or bare metal?

No, Docker containers are not more secure than a VM. Quoting Daniel Shapira: In 2017 alone, 434 linux kernel exploits were found, and as you have seen in this post, kernel exploits can be ...
ThoriumBR's user avatar
  • 54.4k
133 votes
Accepted

If malware does not run in a VM why not make everything a VM?

One has to take into account why the malware is doing this distinction in the first place. Some malware does not run in the VM because the chance is high that this VM is used for inspecting the ...
Steffen Ullrich's user avatar
91 votes
Accepted

Company computers for competent developers, how can you deal with them?

Separate development and production It is usual practice to give developers local admin / root rights on their workstation. However, developers should only have access to development environments and ...
paj28's user avatar
  • 33.4k
85 votes

Is Docker more secure than VMs or bare metal?

Saying either a VM or Docker is more secure than the other is a massive over simplification. VM provides hardware virtualization; the hypervisor emulates hardware so that the guest kernel thinks it ...
Lie Ryan's user avatar
  • 31.4k
67 votes
Accepted

If a container is compromised does that mean host also compromised?

If the kernel is compromised in the container, the host is compromised. Ostensibly, a compromised container should not be able to harm the host. However, container security is not great, and there are ...
forest's user avatar
  • 66.8k
64 votes

Would a VM such as Virtualbox be my best option for everyday security while working?

By using the same VM for browsing, word documents, and email, you are exposing all of your data to the same level of risk. Instead of doing all of this activity in the VM, consider doing your ...
John Deters's user avatar
  • 34.2k
43 votes

Company computers for competent developers, how can you deal with them?

So this answer is from the point of a developer. Keep that in mind. First, not having "local admin" rights on my own machine is a sign that I should look for a job elsewhere. It's nearly ...
coteyr's user avatar
  • 1,556
37 votes

Why can hardware assisted virtualization be a security issue?

My research suggests that you have misinterpreted the meaning of the setting, e.g., see this thread. Avast is capable of using hardware-assisted virtualization to provide better anti-virus ...
Harry Johnston's user avatar
37 votes
Accepted

Norton detects intrusion attempt from virtual machine - how is this possible?

You are assuming that the intrusion is coming from the VM to the hypervisor. A VM "breakout" is when the VM accesses the host directly. An infected VM that has access to the network can ...
schroeder's user avatar
  • 131k
33 votes

Is a Windows XP virtual machine with no network connection safe from hacking?

No - because your VM is inside a machine connected to the Internet it is not safe. It is protected, yes, but that protection is only as good as the protection the host machine provides. An attack ...
Rory Alsop's user avatar
  • 61.5k
27 votes
Accepted

Why can hardware assisted virtualization be a security issue?

In theory, hardware-assisted virtualization can make hypervisor-based rootkits possible. However, this type of malware already requires extremely high privileges and is not a particular threat. ...
forest's user avatar
  • 66.8k
26 votes
Accepted

Meltdown and Virtual Machines

The references you mention don't conflict with each other. The first one claims for Meltdown that "Fully virtualized machines are not affected". The second one claims that the product is "vulnerable ...
Steffen Ullrich's user avatar
24 votes

Is Docker more secure than VMs or bare metal?

As you correctly stated, Docker uses "Operating-system-level virtualization". You can think of this (if you are a *nix fan) as a fancy form of chroot. By harnessing features and functionality built ...
dark_st3alth's user avatar
  • 3,022
21 votes
Accepted

How do big cloud providers guard against VM escape attacks?

Highly customized and patched hypervisors, sandboxes around said hypervisors to mitigate breakouts, and heavy monitoring. Of course, any given server only hosts so many VMs, so a breakout is ...
anon's user avatar
  • 301
21 votes
Accepted

Can .ova file contain an exploit?

Whether or not it contains an exploit, specifically, is irrelevant in the broader question of whether an OVA file can be malicious. The answer to the broader question is yes, absolutely. The Open ...
Polynomial's user avatar
  • 135k
20 votes
Accepted

Why is Kali released as a VM?

Aside from the general isolation and packaging aspects mentioned by other answers, there’s a rather significant benefit to running pentesting tooling in a VM: It lets you snapshot the state of the ...
Austin Hemmelgarn's user avatar
19 votes

Company computers for competent developers, how can you deal with them?

From a developer's point of view: Your job is to prevent change (known bugs and vulnerabilities are better than unknown, right?), but mine is to change things. This puts us at an impasse. My job is ...
Ray's user avatar
  • 191
18 votes

Would a VM such as Virtualbox be my best option for everyday security while working?

In context of a Windows setup, a hypervisor such as VirtualBox, VMware helps isolate your guest from the host (the main installation of your OS). This is a considerate move in terms of Security, if ...
William Sandin's user avatar
18 votes

Why is Kali released as a VM?

Pre-made virtual machines only mean that the tools are installed, configured and tested consistently. That's all. Some tools can be very difficult to get running. It's only for your convenience. Kali ...
schroeder's user avatar
  • 131k
16 votes

Can .ova file contain an exploit?

Any file can contain an exploit. Whether it works or not, or if it requires a loader, is another story. For example, if there's a buffer overflow vulnerability in the processing of .ova files, then ...
Mark Buffalo's user avatar
  • 22.5k
16 votes

Should Virtual Machines be patched for Meltdown and Spectre?

My understanding, first off, is that the OS / hypervisor patch only mitigates Meltdown, not Spectre. Second, you patch the hypervisor to prevent a VM from reading memory belonging to the kernel of ...
Mike Ounsworth's user avatar
15 votes
Accepted

Is a VM safe to run a simple virus on?

The default settings for most VMs will be sufficient for keeping everything isolated, that's what they're designed for. The specific settings might be a little different depending on what software ...
Echo's user avatar
  • 301
15 votes

What is hacking hackable virtual machines useful for?

Think of hacking virtual machines to be the equivalent of being in a shooting range but for pentesting/offsec. It is all about practice. In the real world, how are these practices of hacking ...
mallocation's user avatar
  • 1,676
15 votes

Can a website keylog you outside a virtual machine

TL,DR: Don't be worried, you are probably safe. Usually malware cannot escape the VM onto the host OS. There are exceptions, as some malware are designed specifically to break from the VM into the ...
ThoriumBR's user avatar
  • 54.4k
14 votes

Company computers for competent developers, how can you deal with them?

A security engineer doesn't maintain computers, that's what the service desk does. In your case you will require him to install three tools: a hypervisor docker database software From there he can ...
Lucas Kauffman's user avatar
14 votes

Is a Windows XP virtual machine with no network connection safe from hacking?

It is as safe as a Windows 8.1 machine with an internet connection. Since the VM has no network, the only way to access it would be through the host machine. If the host machine is compromised, you ...
Seth R's user avatar
  • 350
14 votes

Is Docker more secure than VMs or bare metal?

I agree with ThoriumBR's answer if we're just comparing a blank VM with a blank Docker container. It should be noted, however, that properly configuring your system such as in Red Hat's Atomic Host ...
Karl Bielefeldt's user avatar
14 votes

If my machine is infected and I run a Virtual Machine inside of it, will the VM also be compromised

I believe you are asking the wrong question. Whether or not your VM is infected is an open question. To answer it, you can inspect the malware, inspect the VM, draw conclusions, make a guess. But you ...
Tom's user avatar
  • 10.4k
13 votes

Is Docker more secure than VMs or bare metal?

Docker Containers are Not Inherently “More Secure” But the Ability to Quickly Spin Up—and Destroy—Duplicates in a Cluster Is Very Useful from a Security Standpoint. Okay, lots of other answers here ...
Giacomo1968's user avatar
  • 1,184

Only top scored, non community-wiki answers of a minimum length are eligible