Viewing profile — fabiokung

Great response. "..., or ideally don't grant root access to the application." +1

It's possible, but only part of a possible solution. Those tools still would need a (standard) place to read cgroup specific data from inside the container.

Heroku engineer here. Thanks for the suggestion, we will definitely consider it in the future. Meanwhile, there is an add-on that does exactly this: https://addons.heroku.com/proxi…

It is still abstracted, nothing changes from the point of view of most applications. It just opens more possibilities and increases the isolation.

Not all services support unix domain sockets. It's one more option on the table, but I agree that domain sockets should be favored in most cases.

`heroku run bash` is still the best option, but I've always wanted to ssh into heroku dynos myself, so I did this: https://github.com/fabiokung/heroku-ssh