Show HN: Plash – Build and run containers
1–10 of 31 posts
Re: Show HN: Plash – Build and run containers
#2How would you use this to build a docker container within a docker container? This would be an interesting use case for continuous integration where you might have ephemeral building workers.
Re: Show HN: Plash – Build and run containers
#3Will this run alongside virtual box? (In other words, does it need hyper-V turned on on a windows box?
Re: Show HN: Plash – Build and run containers
#4Are there any plans to be backwards-compatible with Dockerfiles and ‘docker-build’?
Re: Show HN: Plash – Build and run containers
#5Some comparisons between the cli of plash and equivalent commands in docker (only because I'm already familiar with it) would be pretty helpful.
Re: Show HN: Plash – Build and run containers
#6I find the first item in the README a bit misleading:
Security: plash containers run completely unprivileged.
- Plash processes have the same operating system access rights than the process
that started it. There is no security relevant isolation feature. Exactly as
with running programs "normally", don't run programs you do not trust with
plash and try to avoid using plash with the root user.
Re: Show HN: Plash – Build and run containers
#7I find the first item in the README a bit misleading: Security: plash containers run completely unprivileged. What this actually means is that plash containers run as the current user, so not as root. But they provide no isolation whatsoever, which I would expect from containers (and which Docker provides, to a certain extent). The README does mention this, but only much later: - Plash processes have the same operati…
https://github.com/projectatomic/bubblewrap
This is the most promising one I've seen.
Re: Show HN: Plash – Build and run containers
#8How is this different from gVisor? Not complaining, this looks very awesome. I am just interested.
This is going to be a great world when we have arbitrary nesting of containers, finally we will have closure :) I think "docker compose" is a big lie.
Re: Show HN: Plash – Build and run containers
#9How would you use this to build a docker container within a docker container? This would be an interesting use case for continuous integration where you might have ephemeral building workers.
Check out kaniko, we built it for that exact use case: github.com/GoogleContainerTools/kaniko
Re: Show HN: Plash – Build and run containers
#10I find the first item in the README a bit misleading: Security: plash containers run completely unprivileged. What this actually means is that plash containers run as the current user, so not as root. But they provide no isolation whatsoever, which I would expect from containers (and which Docker provides, to a certain extent). The README does mention this, but only much later: - Plash processes have the same operati…
https://github.com/projectatomic/bubblewrap This is the most promising one I've seen.
I'm unclear on their readme. Right at the bottom, they seem to suggest that once runC implements rootless containers, it will be a superior solution since it conforms to the Open Containers Initiative.
Checking runC's GitHub, they merged a rootless container branch into their master branch a year ago. A related blog post says it's now inside Docker so very well used.
So does Docker now provide containers that can guarantee immunity from (certain) privilege escalation attacks?
Would you move to Docker/runC?