Looking at using LXD to isolate user logins into their own containers. Users who login with SSH/SFTP/FTPS would login to their container which has only their shared hosting account’s home folder, unable to escape, limited RAM and CPU with cgroups. Goal is total shared account isolation, to prevent attacks on Linux, attacks on neighbor accounts, host system compromise, and data breach. What’s your opinion, how well would this work, how scalable would this be?
Hi @chris001, here is the lxd security information page.
https://linuxcontainers.org/lxd/docs/master/security/
Regards.
To provide more of a subjective take on this: nothing is 100% secure.
Security folks usually say that containers are not sandboxes and that they usually prefer VMs or sandboxes like gVisor.
The thing is though that LXD is very secure (especially compared to e.g Docker) and that even VMs can be broken out of. The important part is that you understand the possible attack surfaces of the different solutions and weigh them based on which probability of exploitation you assign to those.