Containers should not be used as a security mechanism.

I agree with you that VMs would provide better isolation. But I do think containers (or other kernel techniques like SELinux) can still provide quite decent isolation with a very limited performance/ease-of-use cost. Much better than nothing I'd say?

▲

eyberg 5 days ago | parent | next [-]

I would kinda disagree with this. The whole 'better than nothing' is what gave a huge chunk of people a false sense of security wrt containers to begin with. The reality is that there is no singular create_container(2). Much of the 'security' is left up to the runtime of choice and the various flags they choose or don't choose to enable. Others in this thread have already mentioned both bubblewrap and podman. The fact that the underlying functionality is exposed very differently through different 'runtimes' with numerous optional flags and such is what leads to all sorts of issues because there simply was no thought to designing these things with security in mind. (We just saw CVE-2025-9074 last week). This is very different than something like the v8 sandbox or gvisor which was designed with certain properties.

	▲	christophilus 5 days ago \| parent [-]
		It’s a gradient. An airgapped physical device is better than a VM. A VM is better than podman. Podman is better than nothing. A locked door is better than an unlocked one, even if it gives its owner a false sense of security. There is still non-zero utility there.

▲

bryceneal 5 days ago | parent | prev [-]

This is also my impression. Containers aren't full-proof. There are ways to escape from them I guess? But surely it's more secure practically than not using them? Your project looks interesting I will take a look.