• 7 Posts
  • 30 Comments
Joined 1 year ago
cake
Cake day: August 11th, 2023

help-circle



















  • I mean docker and especially lxc do a lot more than just chroot. They use cgroups, namespaces, and other stuff that’s beyond my paygrade. LXC remaps user IDs for example. That’s without getting into tech like gvisor and runsc that further isolates them by restricting system calls and re implementing some of them to increase security. Obviously there are things like privileged containers which have fewer restrictions, but those are the exception not the rule. From what I understand of chroot it only really restricts what files it can see; there is a reason why android supports chroots + termux but not a full docker install. Chroots to me are mainly used for bootstrapping systems and recovering systems. They aren’t meant for real virtualization or server work by themselves if you catch my drift.