retoor/doos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document security verdict versus Docker

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
retoor
2026-10-23 23:26:57 +02:00
co-authored by Claude Sonnet 5.5
parent 97fa625a50
commit 3f4e96937c
4 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5
View File
@@ -168,6 +168,11 @@ run with Docker's default capability set and a seccomp filter. Memory, pids, cpu
`--net host` removes network isolation and is opt-in (`--net pasta` is the safer host-like choice).
What is still not covered is listed at the end of `docs/RESEARCH.md`.
Is it a security-wise Docker replacement? Same class as rootless Podman by design (no root daemon, user namespaces,
seccomp, dropped capabilities, cgroup limits), but unaudited, tested on one machine, with a seccomp denylist and no
per-container AppArmor/SELinux profile. Fine for your own tools; for untrusted code use rootless Podman, gVisor or Kata.
Details: [COMPARISON](COMPARISON.md) section 6.1.
## Development
`make help` lists the targets: `make build`, `make test` (end-to-end, needs network), `make bench` (re-measure startup, sizes and the cpu limit), `make charts` (rebuild the SVG charts and the generated numbers in the comparison), `make docs`, `make release KIND=patch MSG="..."`. Build and test details are in [AGENTS](AGENTS.md); the charts and how they are generated are in [COMPARISON](COMPARISON.md) section 3 and `docs/charts/`.