JLD

Owning a disc hasn’t been synonym with owning a game in a long time. And that was already an issue!

I should have just said that containers are, at the very least, a component in security. There’s this running argument that containers are not meant for security, but if we actually go back to jails in FreeBSD that’s not really the case, so we are in agreement. Isolation is their original goal. And I would argue that isolation is definitely a tool for security.

It’s true that containers were built for reproducibility rather than security, but it’s also true that they can be a helpful tool in securing an environment. Not the ONLY tool, but a helpful one, as they implement kernel namespaces, and, also, tools like podman give you easy access to seccomp-bpf as well. I’ve personally used containers as part of a sandbox for an AI agent, but I integrated quite a lot of security components apart from the container itself, including proper firewall rules on the host level, a landlock ruleset inside the container, a custom seccomp-bpf profile, DNS allowlisting to avoid DNS data exfiltration, and, of course, basic container hardening stuff, like setting the filesystem to read-only, or setting proper uid/gid mapping. There’s a lot you can do with it, but simply containerizing an application won’t secure it by default.

I understand, but now I am the one protecting my mental health. I won’t be a proxy anymore. Instead I’ll take out my popcorn and watch the collapse.

I spent months speaking up against this, and I learn something sad: nobody cares. So now the way I think about it is that apathy leads to its own punishment. It’s depressing.