LinuxCon + CloudOpen + ContainerCon NA 2015

BSD jails, Solaris zones, linux-vserver, and Virtuozzo each define a
jail, zone, or container as a distinct thing which the kernel
uses to isolate a OS level virtualization server. In contrast, modern
Linux containers are based on a number of supporting kernel features,
none of which actually know what a container is. It is up to userspace
to coordinate the use of these features to present container
functionality to the user. Consequently, it is also up to userspace
to do provide the proper "isolation" - in other words, container security.

Linux container security has gone through a few stages. Originally, the
only features available were the first few namespaces themselves and Linux Security Modules (LSMs). Today, user namespaces provide terrific container
isolation. Looking ahead, we expect to use new features in hardware
to protect the kernel from kernel 0-days exp