docker容器是否足够安全，可以与生产系统并排运行第三方不受信任的容器？

Question

We plan to allow execution of third-party micro-services code on our infrastructure interacting with our api. Is dockerizing safe enough? Are there solutions for tracking resources(network, ram,cpu)container consumes?

Answer 1

You can install portainer.io (see its demo , password tryportainer )

But to truly isolate those third-party micro-services, you could run them in their own VM defined on your infrastructure. That VM would run a docker daemon and services. As long as the VM has access to the API, those micro-services containers will do fine, and won't lead/have access to anything directly from the infrastructure.
You need to define/size your VM correctly to allocate enough resources for the containers to run, each one assuring their own resource isolation .

Answer 2

Docker (17.03) is a great tool to secure isolate processes. It uses Kernel namespaces , Control groups and some kernel capabilities in order to isolate processes that run in different containers.

But, those processes are not 100% isolated from each other because they use the same kernel resources. Every dockerize process that make an IO call will leave for that period of time its isolated environment and will enter a shared environment, the kernel. Although you can set limits per container, like how much processor or how much RAM it may use you cannot set limits on all kernel resources.

You can read this article for more information.