I think we've used something similar some time ago (maybe XEN?) and had the following issues, how does Docker compare:
- what happens when one container changes the system clock?
- are iptables rules per container or global?
back
5 comments
Linux network namespaces let you have multiple independent network stacks in linux. That means routing tables, interfaces, routing tables, IP addresses, etc.
Each container gets its own network namespace (along with other namespaces like hostname, pids, users, ipc, filesystem mounts). Anything not handled by one of the 6 namespaces is the same across all containers. That includes things like what kernel modules are loaded, the system clock, etc.
Because a user with root can manipulate the kernel in many ways, I wouldn't give root to an untrusted user and assume containers were enough to contain them. Certainly if they can load a custom kernel module it's game over, but I'd bet there's plenty of other ways to break out too.
See the excellent series of LWN articles, "Namespaces in operation" <https://lwn.net/Articles/531114/> for an overview of how namespaces work on Linux.
To answer your time question: AFAIK there is no namespace for system time in Linux. If you don't want processes within a contaier to be able to set the system clock then don't launch them with the CAP_SYS_TIME capability.
As far as I understand, the clock and such are tied to the base host. Typing 'uptime' in my linux container shows 5 days, the uptime of the base host.
In theory things like the clock could be namespaced too, if anyone found it useful.
That would be useful - sometimes you have to change the system time to debug some code, and if that trips up all the other containers, its a deal breaker for us.
I was thinking more like FreeBSD jails.
Containers can't change the system clock.
Networking for Docker containers is bridged, so iptables are per container.
http://blog.docker.io/2013/08/containers-docker-how-secure-a...