proxmox-mirrors/pve-docs
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-docs synced 2025-10-04 22:47:36 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

pct: move "security considerations" below CT settings

Browse Source 
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2020-02-14 17:47:26 +01:00
parent 3d5c55fca7
commit bf7f598a79
1 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
pct.adoc
View File

@ -86,26 +86,6 @@ Technology Overview
* Container setup from host (network, DNS, storage, etc.)
Security Considerations
-----------------------
Containers use the kernel of the host system. This creates a big attack surface
for malicious users. This should be considered if containers are provided to
untrustworthy people. In general, full virtual machines provide better
isolation.
However, LXC uses many security features like AppArmor, CGroups and kernel
namespaces to reduce the attack surface.
AppArmor profiles are used to restrict access to possibly dangerous actions.
Some system calls, i.e. `mount`, are prohibited from execution.
To trace AppArmor activity, use:
----
# dmesg | grep apparmor
----
[[pct_container_images]]
Container Images
----------------
@ -576,6 +556,26 @@ It will be called during various phases of the guests lifetime. For an example
and documentation see the example script under
`/usr/share/pve-docs/examples/guest-example-hookscript.pl`.
Security Considerations
-----------------------
Containers use the kernel of the host system. This exposes an attack surface
for malicious users. In general, full virtual machines provide better
isolation. This should be considered if containers are provided to unkown or
untrusted people.
To reduce the attack surface, LXC uses many security features like AppArmor,
CGroups and kernel namespaces.
AppArmor profiles are used to restrict access to possibly dangerous actions.
Some system calls, i.e. `mount`, are prohibited from execution.
To trace AppArmor activity, use:
----
# dmesg | grep apparmor
----
Guest Operating System Configuration
------------------------------------