I’ve read that standard containers are optimized for developer productivity and not security, which makes sense.
But then what would be ideal to use for security? Suppose I want to isolate environments from each other for security purposes, to run questionable programs or reduce attack surface. What are some secure solutions?
Something without the performance hit of VMs
This is a problem of the containerized program and the image itself. This problem affect, containers, VM, and baremetal aswel.
I agree. But imo these usecases are more known and mature in traditional setups, we could
apt updateand restart a systemd service and its done.Its not so obvious and there are no mechanisms for containers/images.
(I am not into devops/sysadmin, so this might also be my lack of exposure)
Most often, images are updated automatically and are managed by the developers themselves so images are usually up to date. If you don’t know how to build images, it may be difficult for you to update the containerized software before the vendor does. But this situation is infrequent.
Many projects just pull in a bunch of images from wherever and never update them. Especially if it’s that one obscure image that happens to package this over obscure app you absolutely need.