Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The sad state of sysadmin in the age of containers (2015)

vitavonni.de

Post reply on HN
Print view View original

261–270 of 435 posts

Re: The sad state of sysadmin in the age of containers (2015)

#261

Post by AlexCoventry »

dvfjsdhgfv wrote: post #233
mr_tristan wrote: post #91

This is definitely a rant that obscures the underlying point: the introduction of _untrusted_ or _unreliable_ network resources, frequently hidden in a string of dependencies. I'm baffled how often I see an someone throw this sort of craziness - "go fetch this thing from some random third party" - into very important places, such as the startup procedures of a container. It's something I see in a culture of the two p…

Yes, it's definitely not something related only to Docker, it's today's culture of trusting all possible code only because someone placed it on Github.

There's so much leverage in that code, though. It's clear how the culture evolved.

Re: The sad state of sysadmin in the age of containers (2015)

#262

Post by gaius »

rootlocus wrote: post #237
scurvy wrote: post #194

Earlier quoted context omitted.

It's a legit concern. There was a NANOG panel about this exact thing. I believe the quote was, "Take a look around. We're all old and greying. We have a severe pipeline problem." And then much to AWS' dude's dismay, the topic shifted towards blaming cloud services because no one takes the time to learn how any of this works any more. Want to guarantee your child's future employment? Don't just teach them to code (the…

> Don't just teach them to code (the machines will do that). Teach them how to build networks and truly understand network protocols. Building networks and understanding protocols is something machines can do TODAY. The entire internet was built to survive a nuclear war. It can reshape itself, and it most definitely understand network protocols. By definition, protocols are the language of machines over the network.…

It can reshape itself, and it most definitely understand network protocols

It really, really can't! That quote about the Internet interpreting censorship as damage and routing around it? Or the one about information "wanting" to be free? Taken wildly out of context.

Re: The sad state of sysadmin in the age of containers (2015)

#263

Post by jcastro »

> Essentially, the Docker approach boils down to downloading an unsigned binary, running it, and hoping it doesn’t contain any backdoor into your companies network.

I don't get why people still claim that this is "the Docker approach". This is not the docker approach, everyone hopefully knows this is an anti-pattern by now.

Re: The sad state of sysadmin in the age of containers (2015)

#264

Post by gaius »

dba7dba wrote: post #254
brightball wrote: post #160

Earlier quoted context omitted.

Would be interested to get your opinion on Puppet/Ansible/Chef/CFEngine/SaltStack

+1 for Ansible from me. Of all the tools, I first heard of Puppet first and so I'm assuming it was first on scene? From my limited experience, it seems Puppet is most widely used tool because of that reason. Not necessarily the best of the bunch, but first on the scene. Considering the effort required to roll it out, I am assuming whatever is deployed first will stay as the tool of choice. I've tried out Puppet, Salt…

I first heard of Puppet first and so I'm assuming it was first on scene?

CFEngine was first, it's based on a kind of maths called "promise theory" and it solved the problem of you had many different kinds of Unix owned by many different groups and had to have a consistent way of saying "all machines belonging to group X need to have user Y and package Z" and it would abstract away the slightly differing syntax between Solaris, SunOS, IRIX, OSF/1, Ultrix, yadda yadda. This is a problem that doesn't really exist anymore.

Chef I think came next, it was written by people who knew Ruby but didn't know maths so they used CFEngine terminology like "converging" but Chef doesn't really do that, it just runs Ruby scripts. If CFEngine was a scalpel, Chef is a mallet. Chef and Puppet are related somehow, same group of devs had a falling out and went their own ways, something like that. They are much of a muchness.

Ansible is cool because it recognises the reality of why CFEngine isn't relevant nowadays: most organisations are running just one particular Linux distro so you can do away with the abstraction and get all the benefits without the complexity.

Re: The sad state of sysadmin in the age of containers (2015)

#265

Post by segmondy »

gm-conspiracy wrote: post #243
seorphates wrote: post #205

Earlier quoted context omitted.

Grumpykins here. I think the term "Modern devops" sort of nails it but not quite how you used it. Most departmental/enterprise sys admins/engineers of lore that had even the slightest necessity for life outside the box scaled anything resembling automation to its breaking points. Combined with knowing and serving the reasons for their existence - developers, users etc., and devops is nothing new - it is now simply th…

A good sysadmin would not look like they are doing much work (everything is humming along and can self-heal minus physical problems), but a good devops person is constantly busy.

Great sysadmins get fired unless they learn to pretend to look busy. They automate everything till they have nothing to do.

Re: The sad state of sysadmin in the age of containers (2015)

#266

Post by rootlocus »

gaius wrote: post #262
rootlocus wrote: post #237

Earlier quoted context omitted.

> Don't just teach them to code (the machines will do that). Teach them how to build networks and truly understand network protocols. Building networks and understanding protocols is something machines can do TODAY. The entire internet was built to survive a nuclear war. It can reshape itself, and it most definitely understand network protocols. By definition, protocols are the language of machines over the network.…

It can reshape itself, and it most definitely understand network protocols It really, really can't! That quote about the Internet interpreting censorship as damage and routing around it? Or the one about information "wanting" to be free? Taken wildly out of context.

Then what about routing protocols such as RIP, OSPF, etc? I'm sorry, but I don't know what quotes you're referring to.

Re: The sad state of sysadmin in the age of containers (2015)

#267

Post by gaius »

jcastro wrote: post #263

> Essentially, the Docker approach boils down to downloading an unsigned binary, running it, and hoping it doesn’t contain any backdoor into your companies network. I don't get why people still claim that this is "the Docker approach". This is not the docker approach, everyone hopefully knows this is an anti-pattern by now.

I don't get why people still claim that this is "the Docker approach".

Because it is the Docker approach (as distinct from the container approach necessarily).

Re: The sad state of sysadmin in the age of containers (2015)

#268

Post by pferde »

golergka wrote: post #136

> Back then, years ago, Linux distributions were trying to provide you with a safe operating system. With signed packages, built from a web of trust. Some even work on reproducible builds. > But then, everything got Windows-ized. “Apps” were the rage, which you download and run, without being concerned about security, or the ability to upgrade the application to the next version. Because “you only live once”. These t…

Yes, but when "system administrators" with valuable data just want to do things in a quick and convenient way in production, we've got problems.

Re: The sad state of sysadmin in the age of containers (2015)

#269

Post by gaius »

rootlocus wrote: post #266
gaius wrote: post #262

Earlier quoted context omitted.

It can reshape itself, and it most definitely understand network protocols It really, really can't! That quote about the Internet interpreting censorship as damage and routing around it? Or the one about information "wanting" to be free? Taken wildly out of context.

Then what about routing protocols such as RIP, OSPF, etc? I'm sorry, but I don't know what quotes you're referring to.

Then what about routing protocols such as RIP, OSPF, etc?

Don't forget BGP. I don't think they do what you think they do, at least, not to the extent you think they do them. There is a hell of a lot of manual work in running any sizeable network even within a single organisation.

Re: The sad state of sysadmin in the age of containers (2015)

#270

Post by karlkatzke »

spiderjerusalem wrote: post #249
karlkatzke wrote: post #222

Earlier quoted context omitted.

What makes you think there aren’t young people doing systems administration? Our last two hires in my most recent job were 23 and 27 respectively. Sure, they’re getting trained in the new hot cloud stuff... as the grumpy seniors figure it out first and set patterns... but they are still doing daily work with some rather ancient stuff.

I'm not saying there are no young people doing sysadmin. What I'm trying to say is that if the new 'infrastructure' that all sysadmins learn is not an open UNIXy system where you can grok all the internals if you want to, but closed systems owned by 2-3 major cloud players, then we kinda maybe have a problem in 20 years? Of course, one can argue that that will just cause a new wave of openness and the cycle continues…

Yeah, and my point was that we start the young people that we hire on the open stuff. Then we move them up and on to the other open stuff, which runs on top of the cloud vendors.

(As almost everyone else points out, the closed cloud vendor stuff is nowhere near flexible enough for most moderately complicated use cases unless you’re running at serious scale.)

This is a false crisis.

Post reply on HN