HN

Comments (16)

• js2
  (2016). Previous submissions w/comments:https://news.ycombinator.com/item?id=30623372 (250 points | March 10, 2022 | 27 comments)https://news.ycombinator.com/item?id=22232705 (267 points | Feb 4, 2020 | 29 comments)https://news.ycombinator.com/item?id=15608435 (440 points | Nov 2, 2017 | 53 comments)
• Menu

  abidinberkay
  This was written in 2016. What would be different if you wrote it today? For example would cgroups v2 or newer seccomp features change that much?
• smashed
  Coincidentally I mis-prompted claude code the other day while working on a toy project and failed to specify the project should be built on top of docker and not "like docker".It went on to waste all my tokens creating a specialized docker clone. Cool I guess.
• setheron
  I have written https://fzakaria.com/2020/05/31/containers-from-first-princi... a while ago in similar vein.
• Menu

  ranger_danger
  > I wanted specifically to find a minimal set of restrictions to run untrusted code.I don't think we should consider containers to be a security boundary. Even full VMs can be escaped, and have been, many times.The fact that this is possible in the first place makes me think we need a much better approach.
• tankiya
  [flagged]