What are the disadvantages of containers? What does weaker isolation mean and what can it lead to?

Containers have a number of disadvantages related to their isolation and management features:

• Weaker isolation compared to virtual machines: containers use the host system's kernel and share it, whereas VMs have their own kernel. This means that a failure or vulnerability in the kernel can affect all containers.

• Security: due to the shared OS, containers may be more vulnerable to attacks that exploit kernel or container runtime vulnerabilities.

• Resources: containers can compete for host resources, and without proper limit settings, one container can "starve" others.

• Persistence challenges: containers are ephemeral by default, and additional configuration of volumes is needed to store data.

What does weaker isolation mean and what can it lead to?

It means that processes inside a container are not fully isolated from the host system and other containers. If an attacker gains access to a container, they may attempt to escape from it and access the host or other containers. Also, errors or failures in one container can affect the operation of others.

Therefore, for critical systems, it is important to implement additional security measures: use minimal images, restrict container rights, apply security policies (e.g., SELinux, AppArmor), and isolate containers at the network and resource levels.