Painless Docker - 2nd Edition

Docker vs. VMs: Which is more secure?

Docker containers are often compared to virtual machines for pedagogical reasons. Many introductory resources emphasize the advantages of containers, such as being lighter, faster, and not requiring a separate guest operating system or a traditional hypervisor. While these comparisons are useful, it's important to examine the security implications more carefully.

Next, we will explore the security characteristics of virtual machines and Docker containers, highlighting their respective advantages and drawbacks.

Virtual Machines

Drawbacks:

• Virtual machines run a full guest operating system, which increases the overall attack surface and the number of components that must be secured and patched.

Advantages:

• Virtual machines provide strong isolation. Each VM runs its own kernel and user space, isolated from other VMs by the hypervisor. This hardware-assisted isolation can reduce the impact of certain classes of attacks.
• At the same time, even though containers aren't new, the concept of virtualization has been used in production environments for decades and is well understood, with mature tooling and security practices.

Docker Containers

Drawbacks: