Top all-time · #2215
Aqua
Company blog · blog.aquasec.comsecurityprogramming
Aqua is the company blog at blog.aquasec.com, writing about security and programming. Since 2017, 33 different Hacker News readers have linked it 37 times, most often “A Brief History of Containers: From the 1970s to 2017”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (11) to say how often HN recommends it.?
Why HN links it
HN readers link Aqua's blog for container security research: CVE write-ups such as CVE-2022-0185 and Looney Tunables, a history of Linux containers, and VS Code extension risks.
Summarised by Claude from a sample of 11 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Expert insight, best practices and advice on cloud native security, trends, threat intelligence and compliance.
Most-linked posts?
- A Brief History of Containers: From the 1970s to 20176 people · 6 mentions · first linked 2019-03-10
- Organized attack that targets misconfigured open Docker Daemon API ports3 people · 3 mentions · first linked 2020-04-05
- Deceptive Deprecation: The Truth About NPM Deprecated Packages3 people · 3 mentions · first linked 2024-01-19
- Can You Trust Your VSCode Extensions?3 people · 3 mentions · first linked 2023-01-12
- GitHub Dataset Research Reveals Millions Potentially Vulnerable to RepoJacking3 people · 3 mentions · first linked 2023-06-23
- CVE-2022-0185 in Linux Kernel Can Allow Container Escape in Kubernetes3 people · 3 mentions · first linked 2022-01-24
- Kubernetes Pod Escape Using Log Mounts2 people · 2 mentions · first linked 2019-08-02
- Public Travis CI Logs (Still) Expose Users to Cyber Attacks2 people · 2 mentions · first linked 2022-06-14
What Hacker News says?
(Same discussion as on lobste.rs) Thank you for this link, I've only seen the initial CVE announcement. > This is not FUD [...] The site is practicing FUD, it accomplishes communicating a message in an untruthful fashion by mixing two different things into one. (Just check out their stack overflow links, it is not clear if they are talking about root or `--privileged`) People are confused wether `docker root == host…
Comment linking /docker-security-best-practices
on “Simple Dockerfile examples are often broken by default”Submitted A Brief History of Containers: From the 1970s to 2017 as a story · 7 points
HN discussionEven earlier was Linux VServer, which was 2001 :) So yeah, Linux containers have been around in one form or another for over a decade before Docker helped popularise things. This makes some interesting reading: https://blog.aquasec.com/a-brief-history-of-containers-from-...
Comment linking /a-brief-history-of-containers-from-1970s-chroot-to-docker-2016
on “Goodbye Docker and Thanks for all the Fish”Submitted Public Travis CI Logs (Still) Expose Users to Cyber Attacks as a story · 4 points
HN discussion> Containers already existed Fascinating. I'm admittedly very new to container-land, but my understanding was precisely the opposite - that Docker invented this concept and practice of building a runtime environment that can then be replicated and deployed to many hosts. Do you have any search terms or articles I should pursue to learn more about the predecessors? I've read through this[0], but it mostly suggests th…
Comment linking /a-brief-history-of-containers-from-1970s-chroot-to-docker-2016
on “Permissive forwarding rule leads to unintentional exposure of containers (2021)”Submitted Adopting Zero Trust in Kubernetes: The Fundamentals as a story · 3 points
HN discussionNot sure if this is common knowledge (??) but I feel I should note here: in my job we absolutely do not consider containers to be a security boundary[1]. On the other hand I still tend to use them for isolation on my personal boxen, because they at least reduce the blast radius of bugs or shitty packaging. [1] Random search result that appears to corroborate my claim: https://blog.aquasec.com/container-isolation
Comment linking /container-isolation
on “ImageMagick: CLI for Image Editing”Submitted Deceptive Deprecation: The Truth About NPM Deprecated Packages as a story · 2 points
HN discussionThey aren't all over the place, in fact they are far more advanced than whatever you're referring to. Containers on Linux have also existed for a long time: https://blog.aquasec.com/a-brief-history-of-containers-from-... The containerization solutions you're referring to didn't gain widespread adoption like Docker and Kubernetes because they weren't as polished and lacked features and functionality that is available…
Comment linking /a-brief-history-of-containers-from-1970s-chroot-to-docker-2016
on “Running Docker on Apple Silicon M1 (Follow-Up)”Submitted Deceptive Deprecation: The Truth About NPM Deprecated Packages as a story · 2 points
HN discussionIt doesn't but TBH user namespaces have a mixed record when it comes to security. For example CVE-2022-0185 wasn't exploitable from a standard container unless user namespaces were available allowing additional capabilities to be gained, inside that user namespace ( https://blog.aquasec.com/cve-2022-0185-linux-kernel-containe... has more details.
Comment linking /cve-2022-0185-linux-kernel-container-escape-in-kubernetes
on “Escaping privileged containers for fun”Submitted GitHub Dataset Research Reveals Millions Potentially Vulnerable to RepoJacking as a story · 2 points
HN discussionThe original write-up is linked from this post https://www.crowdstrike.com/blog/cr8escape-new-vulnerability... - Good, lots of details on exact reproduction. One idea for mitigation before you can get a patch out for this would be to use admission control (e.g. OPA/Kyverno) to block setting custom sysctls altogether or blocking the characters used in the attack. There's some notes on that https://blog.aquasec.com/cv…
Comment linking /cve-2022-0811-cri-o-vulnerability
on “Container escape flaw fixed in CRI-O runtime engine”Submitted Public Travis CI Logs (Still) Expose Users to Cyber Attacks as a story · 2 points
HN discussionDirect link to the blog [1] [1] - https://blog.aquasec.com/loony-tunables-vulnerability-exploi...
Comment linking /loony-tunables-vulnerability-exploited-by-kinsing
on “Exploited 'Looney Tunables' Linux privileged escalation bug Kinsing threat actor”Submitted CVE-2022-0185 in Linux Kernel Can Allow Container Escape in Kubernetes as a story · 2 points
HN discussionIs VS Code a text editor? I wouldn't consider anything that has internet access permissions or a suite of 3rd party user plugins/extensions a text editor but that's just me. Giving VS Code express permission to your home/filesystem (the default if you install it traditionally) is a security risk [0] [1] most people rarely think about. [0] https://blog.aquasec.com/can-you-trust-your-vscode-extension... [1] https://ww…
Comment linking /can-you-trust-your-vscode-extensions
on “Why is Debian the way it is?”Submitted Organized attack that targets misconfigured open Docker Daemon API ports as a story · 2 points
HN discussion> However both are pretty much mimicked concept from Solaris Zones Your timeline is off. FreeBSD and Linux were within a year of each other (not in-tree on linux, but Debian packaged VServer kernels and VServer + GRSec kernels; we used vserver+grsec debian packaged kernels at work in the mid through late '00s). Solaris containers came years later. 2000 - FreeBSD jails 2001 - Linux VServer 2004 - Solaris Containers h…
Comment linking /a-brief-history-of-containers-from-1970s-chroot-to-docker-2016
on “Jails on FreeBSD”Submitted Threat Alert: Kinsing Malware Attacks Targeting Container Environments as a story · 2 points
HN discussionMultiple CVEs for escaping? E.g.: * https://blog.aquasec.com/cve-2022-0185-linux-kernel-containe... * https://securitylabs.datadoghq.com/articles/dirty-pipe-conta... * https://snyk.io/learn/docker-security/top-5-vulnerabilities/ * https://www.container-security.site/attackers/container_brea... The only escaping of jails that I've heard of in the last ~20 years is one not in the jails code, but tunnelling out through…
Comment linking /cve-2022-0185-linux-kernel-container-escape-in-kubernetes
on “Jails on FreeBSD”Submitted A Brief History of Containers: From the 1970s Till Now as a story · 2 points
HN discussionSubmitted Kubernetes Pod Escape Using Log Mounts as a story · 2 points
HN discussionSubmitted Kubernetes Pod Escape Using Log Mounts as a story · 2 points
HN discussionSubmitted Managing Secrets in Docker Containers as a story · 2 points
HN discussionSubmitted Deceptive Deprecation: The Truth About NPM Deprecated Packages as a story · 1 points
HN discussionSubmitted Kubernetes Exposed: One YAML Away from Disaster as a story · 1 points
HN discussionSubmitted GitHub Dataset Research Reveals Millions Potentially Vulnerable to RepoJacking as a story · 1 points
HN discussionSubmitted GitHub dataset research reveals millions potentially vulnerable to RepoJacking as a story · 1 points
HN discussionSubmitted CorePlague: Severe Vulnerabilities in Jenkins Server Lead to RCE as a story · 1 points
HN discussion
