Container security models

Moving up from the hardware layer and how the hypervisor and base operating system mediate access to it, we can begin to review what happens at the software layer running at ring level 3. To explore this, there are two key features of Docker's container security model that we need to understand:

• Applications are isolated from the underlying host system.
• Containerized applications are isolated from each other.

So, how does Docker achieve these objectives? The answer to this is, as you may have guessed, via Docker Engine and related components, such as containerd. These components have inherited a number of key Linux features and concepts with major benefits for security, including the following:

• runc: A lightweight container runtime
• Namespaces: A Linux method for partitioning kernel resources
• Control groups (cgroups): A kernel feature for limiting resources such as CPU usage

Additionally, it also allows the implementation...