We have a requirement to replace Solaris zones with Linux containers, that's why we are evaluating LXC1 containers.

Since it's not safe to run privileged containers, can anyone shed some light as to when it's necessary to run containers in privileged mode? As running them in unprivileged mode would require a lot of tinkering with scarcely documented CAPs (Linux capabilities) apparmor/ selinux contexts, cgroup controls (depending on unique requirements in each application's case)?

  • Even if you ran the containers with root permissions, in a server hardening environment with SELinux or Apparmor, the processes would still run sand-boxed and so you would still have to run some configuration. – Raman Sailopal Aug 4 '17 at 13:13
  • Thanks. That means for running financial industry grade containers, the admin would need to master a myriad of technologies like seccomp, selinux, control groups etc. – Junaid Shahid Aug 4 '17 at 13:24
  • There are tools that allow selinux to build profiles in "self learning" mode I.e. auditallow. I would suggest that a financial industry grade server shouldn't even contemplate running any processes as a root user. – Raman Sailopal Aug 4 '17 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.