CONTAINERS ARE NO LONGER A SECURITY BOUNDARY

Summary from the TLDR InfoSec newsletter

The traditional view of containers as a strong security and isolation mechanism is being eroded by the plethora of kernel vulnerabilities being uncovered. This article explains how a recent vulnerability in the AF_UNIX subsystem can be leveraged by attackers for container escapes. The authors recommend moving untrusted workloads to MicroVMs like Firecracker or Kata Containers for untrusted workloads.