Securing Windows Server containers

This section looks at security in the context of isolation modes.

Windows Server containers provide two isolation modes: process and Hyper-V isolation. The degree of isolation that’s created between each container and the host OS differentiates these isolation modes. Let’s outline each mode:

• Process isolation (this is the traditional isolation mode):
  • The same kernel is shared between the containers and the host
  • There is a user mode per container
  • When starting a Docker container, the –isolation=process command switch is used
• Hyper-V isolation:
  • With this isolation mode, there is a kernel per container
  • Each container runs inside a VM
  • Hardware-level isolation is provided between each container and the host
  • When starting a Docker container, the –isolation=hyperv command switch is used

These two isolation modes are shown in the following diagram:

Figure 10.2 – Isolation modes

Process...