It absolutely and ultimately has to be a user choice as to how much security does he need, since there are absolutely different use cases. One could envision the world with no apt, yum, brew, chocolatey and such where all the software basically distributed as containers - and it would be hard to get to that world if portability principal is neglected in favor of total isolation.

Ability to distribute and run not just applications but entire ecosystems at our laptops that guarantees the execution environment across the different users and automated systems is a big deal. Surely enough the ability to run applications securely in an isolated way is crucial and it had dramatic impact and completely transformed Software Engineering as we know it today.īut Portability is another one that is often remains in the shadow of the first one, yet should not be underestimated as both of them are yin and yang of the containerized world.

Isolation is one of them and it seems to have the most attention. I mean, what makes you think that Docker should be in position to be making decisions as to what user can and can't mount to his own containers on his own system? What was the use case to even have this filtering implemented with no ability for the user to have items added and removed from it in the first place? This seems like a huge overreach from the Docker side and it troubles me very much - like what's next going to be limited for the sake of user's own protection, maybe running unauthorized containers from other than Docker Hub sources should be disallowed?Īnd to add some context (and pardon me for the multiple messages, but they are different aspects of a complex issue and to me they are appear to be logically separate), I would like to point out that there are two major use cases for Docker. I don't want to appear ungrateful for your work or something, but I'm very troubled and concerned while trying to wrap my head around the very idea that somebody even had to give you a use case for something like that. Thanks for the use cases for (subdirectories of) ~/Library We don't see a use case for sharing that, and it will cause performance problems to do so because the docker logfiles are written there.

Docker for mac file sharing