Intel SGX Enclave with Qubes

[fsflover]

@Zaro

If I run the VMs in a docker, via DOM0 how much does the attack surface increase?

In this case you stop relying on the Qubes hardware isolation and rely on Docker instead, which is far less secure. If dom0 is compromised, everything is compromised, which is why you should run in dom0 as few things as possible (ideally, nothing!).

See also:

Docker vs. QubesOS

I’m going to be a bit of an annoying noob, I read this article about how QubesOS stacks up against VM, however it does not address Docker containers (though it does address older types of containers). If we are to disregard the insecurity of the underlying OS, docker containers do seem to have some advantages over traditional VMs: they are lighter weight, and they seem more secure. It is built into docker that it is suppose to be very difficult to “escape” a docker container. In addition you can…