21–30 of 80 posts
This makes me feel good about going with CentOS for Docker. Red Hat has a custom, stable Docker version which is rock-solid (albeit somewhat old, 1.10).
Center for Internet Security Docker Benchmark, rule 1.5: Keep Docker up to date [1] [1] https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1...
Earlier quoted context omitted.
There's more than one type of container. Docker, and docker flavors (runc, rkt, etc). LXD is a machine container, it's the same technology that Docker was first built off of, but it's a hypervisor for really dense machines that are as light as process containers. Snaps is a package format that gives you a cross (linux) platform distribution, atomic updates, security, and isolation. It's not really like docker as it's…
like xen? I sat on a 10 minute presentation during openstack meetup, Ubuntu dude presented LXD...then I asked myself...xen does all this...then again choice is always welcomed
Earlier quoted context omitted.
There's more than one type of container. Docker, and docker flavors (runc, rkt, etc). LXD is a machine container, it's the same technology that Docker was first built off of, but it's a hypervisor for really dense machines that are as light as process containers. Snaps is a package format that gives you a cross (linux) platform distribution, atomic updates, security, and isolation. It's not really like docker as it's…
like xen? I sat on a 10 minute presentation during openstack meetup, Ubuntu dude presented LXD...then I asked myself...xen does all this...then again choice is always welcomed
This makes me feel good about going with CentOS for Docker. Red Hat has a custom, stable Docker version which is rock-solid (albeit somewhat old, 1.10).
Earlier quoted context omitted.
like xen? I sat on a 10 minute presentation during openstack meetup, Ubuntu dude presented LXD...then I asked myself...xen does all this...then again choice is always welcomed
The VM experience ("guests") without the VM overhead. A virtual machine like Xen or KVM or ESX lets you run a guest kernel of a different OS, like WIndows. LXD avoids the overhead of hardware virtualisation and the guest OS, which means it only supports Linux guests, but they run at native speeds.
or the VM security
I really want to like docker for end user applications. However, until the problem of sanely sharing users into the container is solved, it is something that merely works well right up to the point you try to do something useful. I suppose this can be sidestepped by allowing root in all of your containers for the applications. I am curious if that actually provides security benefits, though.
What do you mean by sanely sharing users in the container?
First, you'll find that the user used to setup the container was not you. So you can't even just map in your .ssh dir.
So you'll try modifying the image to work with specified user at start up. Only, again, it wasn't setup that way. You will start modifying the entire image to work, but will hit tons of assumptions on user name. (You may get lucky here. I didn't.)
So then you think to just run as root so that the user in the container will have permission to your .ssh files. At first you forget to specify user name on ssh commands, since the command thinks you are root now. easy enough, at least.
Only, you forgot you have proxy commands in your config and other scripts that you now have to edit because they rely on your user name. So you can fix that.
Now you can finally do what would have been trivial for an app installed on your machine.
Earlier quoted context omitted.
The VM experience ("guests") without the VM overhead. A virtual machine like Xen or KVM or ESX lets you run a guest kernel of a different OS, like WIndows. LXD avoids the overhead of hardware virtualisation and the guest OS, which means it only supports Linux guests, but they run at native speeds.
> without the VM overhead or the VM security
Can OP or an admin de-abbreviate "CS" to "Commercially-Supported"?
This makes me feel good about going with CentOS for Docker. Red Hat has a custom, stable Docker version which is rock-solid (albeit somewhat old, 1.10).
Depending on your use case, that may not be such a great idea. Unless Red Hat have back-ported it, 1.10 misses several important security advances that have come into Docker in recent versions...
Source: https://github.com/projectatomic/docker/tree/410e23a7eeb52d4...