Top all-time · #6385
S3hh's Blog
Personal blog · s3hh.wordpress.comsystemsprogramming
S3hh's Blog is a personal blog at s3hh.wordpress.com about systems and programming. Since 2012, 13 different Hacker News readers have linked it 13 times, most often “Creating LXC containers without root privileges”. It is still writing: the last post was on 2025-05-25, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN commenters link this post in threads on Docker security, where they debate whether root inside a container can escape isolation. None of the comments judge the post itself.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Just another WordPress.com site
Most-linked posts?
- Creating LXC containers without root privileges3 people · 3 mentions · first linked 2013-08-05
- Timeline of Linux Containers2 people · 2 mentions · first linked 2018-03-24
What Hacker News says?
Docker is not designed to isolate the root user from the rest of your system, and containers/capabilities are not MAC-based security. Docker strips 16 capabilities when it runs a container, leaving 23 additional capabilities to be abused by root, and whatever other vulnerabilities are left that capabilities don't cover. To prevent this you need guest isolation via virtualization. https://wiki.ubuntu.com/LxcSecurity…
Comment linking /2013/07/19/creating-and-using-containers-without-privilege/
on “One of my Drupal sites was hacked”Submitted Ambient capabilities as a story · 2 points
HN discussionDocker hopefully will be a little different in a year as it will offer solid security isolation (which is not the case now). Right now if you run a Docker container and run something within it as root, if that application gets compromised someone can break out of that container and alter the master (due to the way Docker links container-root and system-root, a root user in a container is effectively a root user on t…
Comment linking /2013/07/19/creating-and-using-containers-without-privilege/
on “Weave – The Docker Network”Submitted Creating LXC containers without root privileges as a story · 2 points
HN discussionThere are some circumstances where that might not work as seamlessly as possible (such as with user namespaces -- runc and LXC set those up slightly differently and run hooks in slightly different orders and contexts) but it wouldn't be too hard to get it to work. I did a quick search, and it turns out that making CNI work under LXC did require some patches (though I'm not sure if they were CNI or LXC patches -- the…
Comment linking /2017/10/19/cni-for-lxc/
on “Docker 19.03: Rootless Mode (Experimental)”Submitted History of Containers as a story · 1 points
HN discussionSubmitted My phone’s not dumb, it just looks it as a story · 1 points
HN discussionSubmitted Timeline of Linux Containers as a story · 1 points
HN discussionSubmitted Docker in LXD as a story · 1 points
HN discussionSubmitted Introducing lxcfs as a story · 1 points
HN discussionSubmitted Where does lxd fit in as a story · 1 points
HN discussionSubmitted Experimenting with user namespaces as a story · 1 points
HN discussionSubmitted Easily making a blockdev available to a container as a story · 1 points
HN discussion
