Does it help in terms of security to run different classes of containers (critical, important, scratch) under different users on a hypervisor?
Apologies for the long title.
Essentially, is it a good idea in terms of security to have different VMs running under different users on the main hypervisor? For example: running Rocky Linux as the Type-1 hypervisor, then running critical (for the infrastructure) VMs such as the DNS and DHCP server under user 1, running important VMs (like the media server) under user 2, and finally running throwaway VMs (for testing) under user 3?
I have yet to delve into SELinux and general security practices in locking down one's hypervisor, but I aim to achieve a high-level of security in my homelab environment (maybe even go full zero-trust).
Threat model is someone who is already in my network and is attempting to access my hypervisor. Does having different users prevent an attack from this angle? What are the security policies/frameworks I should be looking at to secure my server even more?
Thanks!
Posted Jan 8, 2024, 12:58 AM UTC