question - Infiniband job isolation about batch-shipyard HOT 3 CLOSED

@hopoffbaby For infiniband, this is currently not possible since containers use the host networking stack (there may be a way to bridge the IB network interface, but I'm not sure how that would work). With recent versions of Docker (certainly versions installed by Batch Shipyard), filesystem safety between running containers is a reasonable expectation (if you are not mounting shared host directories into the container and are not exposing the docker socket into the container). You can further isolate by using user namespaces via the user identity properties available.

In general, if you are targeting for hostile multi-tenancy, pure non-virtualized Docker containers is the wrong model. Pool boundaries are the proper isolation level between users. Right now, there is no support for "thin-VMs + containers" in Azure suitable for hostile multi-tenancy with the isolation boundary on containers.

from batch-shipyard.

Just to add, the reason being is I have to consider all data and files for each job potentially malicious.

Thanks,
h

from batch-shipyard.

Closing, please re-open if you have additional questions about this topic.

from batch-shipyard.