On: Dramatically Reducing Software Vulnerabilities [pd...

[hueving]

Note that it doesn't say that containers are secure. It just implies that they can be used to help with security practices like principle of least privilege for processes.

In other words, containers are better than running normal processes for security. Not better than running a VM.

[tyingq → hueving]

Agreed. But, seems odd to mention "principle of least privilege" when unprivileged containers aren't the default :)

(yes, I get those are two different scopes of the word privilege)