Learning Docker - Second Edition

SELinux for container security

Security-Enhanced Linux (SELinux) is a brave attempt to clean up the security holes in Linux containers and is an implementation of a Mandatory Access Control (MAC) mechanism, Multi-Level Security (MLS), and Multi-Category Security (MCS) in the Linux kernel. There is a new collaborative initiative, referred to as the sVirt project, which is being built on SELinux, and this is getting integrated with Libvirt to provide an adaptable MAC framework for VMs as well as containers. This new architecture provides a sheltered separation and safety net for containers, as it primarily prevents root processes, within the container, from interfacing and interfering with other processes running outside this container. Docker ...