Comparison
Container escapevsLinux namespaces
Container escape
the attacker got out of the container onto the node, and from the node to every other tenant's workload on it.
Getting from inside a container to the host, usually via a kernel vulnerability, an over-permissive capability, a mounted host path or a mounted container socket. It is the reason containers are called an isolation mechanism rather than a security boundary: everything shares one kernel. The practical defences are unglamorous — run as non-root, drop capabilities, never mount the runtime socket, and keep nodes patched.
Full entry →Linux namespaces
the container sees PID 1, its own network interfaces and its own mount tree, all of which are a partial view of the host's.
The kernel feature that gives a process a private view of a global resource — process IDs, mounts, network stack, hostname, users. It is the other half of containerisation: namespaces do the isolation, cgroups do the limits. Understanding that both are per-kernel features is what makes it obvious why a container is not a security boundary of the same class as a virtual machine.
Full entry →