Comparison
Container escapevsTenant isolation
Container escape
the attacker got out of the container onto the node, and from the node to every other tenant's workload on it.
Getting from inside a container to the host, usually via a kernel vulnerability, an over-permissive capability, a mounted host path or a mounted container socket. It is the reason containers are called an isolation mechanism rather than a security boundary: everything shares one kernel. The practical defences are unglamorous — run as non-root, drop capabilities, never mount the runtime socket, and keep nodes patched.
Full entry →Tenant isolation
you decide whether a namespace is enough or whether each customer needs their own cluster, and the answer is about who you are defending against.
The strength of the boundary between tenants, which ranges from logical separation inside one cluster to separate clusters, accounts or hardware. Containers share a kernel, so a namespace is a fairness and access-control boundary rather than a defence against a determined attacker. Choosing the level is a threat-model decision, and it is the most expensive thing to change later.
Full entry →