# Containers, Security, and Echo Chambers

DevFeed: [Containers, Security, and Echo Chambers](<https://devfeed.tech/articles/containers-security-and-echo-chambers-35155.md>)

Original publisher: [Read original article](<https://blog.jessfraz.com/post/containers-security-and-echo-chambers/>)

Published: 2018-05-20T19:17:58Z

Content type: opinion

Language: en

Sources: [Jessie Frazelle](<https://devfeed.tech/sources/jessie-frazelle.md>)

Topics: [Containers](<https://devfeed.tech/topics/containers.md>), [Security](<https://devfeed.tech/topics/security.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [SELinux](<https://devfeed.tech/topics/selinux.md>), [Linux Kernel](<https://devfeed.tech/topics/linux-kernel.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>)

Tags: [containers](<https://devfeed.tech/tags/containers.md>), [docker](<https://devfeed.tech/tags/docker.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux-kernel](<https://devfeed.tech/tags/linux-kernel.md>), [security](<https://devfeed.tech/tags/security.md>), [selinux](<https://devfeed.tech/tags/selinux.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

An opinion article argues that container security should rely on layered isolation and secure defaults, discussing Docker's Seccomp and AppArmor profiles, Linux kernel isolation, and efforts to bring these protections to Kubernetes. It responds to messaging around gVisor and sandboxing.

## Source excerpt

There seems to be some confusion around sandboxing containers as of late, mostly because of the recent launch of gvisor. Before I get into the body of this post I would like to make one thing clear. I have no problem with gvisor itself. I think it is very technically "cool." I do have a problem with the messaging around it and marketing. There is a large amount of ignorance towards the existing defaults to make containers secure. Which is crazy since I have written many blog posts on it and given many talks on the subject. But I digress, let's focus on the part of the README that mentions sandboxing with SELinux, Seccomp, and Apparmor. It says: "However, in practice it can be extremely difficult (if not impossible) to reliably define a policy for arbitrary, previously unknown applications, making this approach challenging to apply universally." Greetings. Reporting for duty. Literally I am the person who can do that. I was the person who did do that. I added the default Seccomp profile to Docker and maintained the default Apparmor profile. I have also done A LOT of research with regard to Linux kernel isolation and making containers secure. I also literally reported for duty, two years ago and made the patch to add the Seccomp annotation to Kubernetes... with the hopes of eventually turning on a default filter. @nathanmccauley @brendandburns @kelseyhightower @thockin I already offered to help -- jessie frazelle (@jessfraz) April 5, 2016 All big organizations have problems with "not invented here." I tried my very best to inform everyone how these sandboxing mechanisms work but I am going to try one last time here. More than One Layer of Security Required In my last blog post, Hard Multi-Tenancy in Kubernetes, I mentioned this as well. It is also a good read if you want to learn about the thought process for secure isolation. To be truly secure you need more than one layer of security so that when there is a vulnerability in one layer, the attacker also needs a vulnerab