Virtualization and hypervisor security models
In previous chapters, we explored how Docker works and how it compares to other technologies, such as FreeBSD jails and virtualization. Building on what we learned here, we will now seek to understand the security model that underpins Docker better.
To start with, let's look at how security is implemented by virtualization tools so that we can then understand how Docker matches and differs from them.
Virtualization and protection rings
When using virtual machines (VMs), you may have come across the term hypervisor. This is a program that orchestrates how the VMs run on your system and interact with the underlying hardware. Some hypervisor products, known as type 1 hypervisors, run directly on top of the hardware. Others, such as VirtualBox, are installed via your existing operating system and allow you to load additional operating systems as VMs.
How the hypervisor works with the underlying hardware is governed by what...
