Why containers are less secure that virtual machines?

Unlike VMs, every container on a host shares the single, monolithic OS kernel. Any vulnerability reachable from one container is therefore reachable from all, enlarging the attack surface that must be defended and making kernel-level compromise far easier than in hypervisor-isolated VMs. Hypervisors present a much smaller, purpose-built interface, while containers expose the full kernel API (syscalls, namespaces, cgroups), so one kernel-escape bug can give an attacker control of the whole host and every container.

B. Disk-filling denial-of-service can be performed from either VMs or containers; it is not a container-specific security weakness.

C. CPU starvation is a generic resource-exhaustion issue mitigated by quotas for both VMs and containers; not unique to container security.

D. Containers can be isolated with separate bridges, VLANs, or network namespaces; shared virtual networks are a configurable choice, not an inherent insecurity.

1. NIST SP 800-190 “Application Container Security Guide”

§3.1

p.10: “Because containers share the host OS kernel

the kernel’s attack surface is considerably larger than that of a hypervisor…”.

2. Red Hat “Introduction to Container Security” (Red Hat Customer Portal)

section “Kernel sharing increases risk”: “All containers rely on one kernel; any kernel exploit compromises the host and every container.”

3. MIT 6.828/6.5840 Operating Systems Engineering

Lecture 18 “Containers & Isolation”

slide 9: “Containers expose entire Linux syscall interface; hypervisors expose a much smaller surface.”

4. Wang et al.

“Containers vs. Virtual Machines: A Systematic Security Analysis”

IEEE Cloud 2018

§4.2: “Shared kernel broadens attack surface and makes privilege escalation easier compared to VM hypervisors.” (https://doi.org/10.1109/Cloud.2018.00027)