Hacker News Reader

Explain? I'm aware that giving a host user permission to control Docker is equivalent to root, but that's no worse than wheel/sudo in most cases, and not a "sandbox" failure. So I assume you're thinking of container escape, which I was given to believe is actually hard these days?

View on HN

What makes you to think it's easier anyway?

Docker use shared resources like Kernel. Linux Kernel is big ugly C mess (Compared to includeOS) and probably one can find a good enough exploit for the kernel then escape the Docker.

That's and VM provides much better security. Well, VM escape exploits exists but they are at least much harder than say a Docker level escape.

Reply on news.ycombinator.com