Re: Fedora/RedHat is moving is a similar direction

On Sat, Sep 5, 2015 at 12:28 PM, Sergio Tortosa Benedito
<[email protected]> wrote:

>> You should be able to do that with Docker.
> Let's take the most lightweight way of having another OS inside an already
> existing one: chroot, even with that the system might have to load a lot of
> stuff (libraries, config, resources...) , however much of these stuff might
> already be inside the host and thus duplicating them.

That's true, but maybe some duplication also contributes to security?

>> > All within 1 user account, so that this can be done for multiple
>> > users, side-by-side, even concurrently on a multiuser host.
>> >
>> > It is nothing to do with user accounts; these are irrelevant to it.
>>
>> But isolating users to there own contained OS on a multi-user system
>> would nonetheless be a step in the right direction, wouldn't it?
> Well, remember we are unix (sort-of) and as far as I remember, unix already
> does this, right?
> Even for those parts where unix itself is not enough, we already have
> policies(SELinux), which I think are more flexible anyway.

Hmm.. then why is that not good enough for applications too? I know on
my Debian system Apache runs as www-data user, for instance.

> Don't worry, the lock on the front door is there :).

:-)