Exploiting a system with an evil Docker container

You might think that containers are somewhat like virtual machines, and you’d be partly correct. The difference is that a virtual machine runs an entire self-contained operating system, and a container doesn’t. Instead, a container comes with the guests operating system’s package management and libraries, but it uses the kernel resources of the host operating system. That makes containers much more lightweight. So, you can pack more containers on a server than you can virtual machines, which helps cut down on hardware and energy costs. Containers have been around for quite a few years, but they didn’t become all that popular until Docker came on the scene.

But, the very thing that makes containers so lightweight – the fact that they use the host machine’s kernel resources – can also make for some interesting security problems. Using some form of MAC is one thing you can do to help...