Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Container networking is simple (2020)

iximiuz.com

Post reply on HN
Print view View original

21–30 of 68 posts

Re: Container networking is simple (2020)

#21

Post by MaxBarraclough »

29athrowaway wrote: post #16
m463 wrote: post #4

It is if you use: --net=host

Which defeats the purpose of containerization because now the container can sniff traffic on the host, hijack TCP connections, etc.

If you're running untrusted code in your container, you've pretty much already lost.

Containers are useful for deployment and configuration, they are not a robustly secure sandbox. For that you still need to go with a VM.

No cloud provider will offer to run your containers alongside other customer's containers, on a shared kernel. Your containers always run within your own VM.

Re: Container networking is simple (2020)

#22

Post by skrtskrt »

caymanjim wrote: post #12

This is...not simple. I agree that container networking is not all that much different from other Linux networking, but that doesn't make it simple. A lot of application developers are switching to working with containers and haven't historically had to do any manual network configuration. It's all new to them. Linux networking conventions change every few years and simplying keeping up with the basics is a chore. ne…

Any good books on Linux networking?

I have started spinning up “bare metal” k8s on a cloud VM and it’s not that hard to get going until you get to anything networking related then I feel like I’ve just jumped off a cliff. I have no knowledge there and the online resources seem to be nonexistent because you’re expected to just use a prebaked solution from cloud providers.

I ended up just installing k3s but I have yet to figure out where the Traefik packaged in k3s can listen directly on port 80 and 443, but the basic Traefik installed via Helm cannot

Re: Container networking is simple (2020)

#23

Post by pnutjam »

stonesweep wrote: post #15
caymanjim wrote: post #12

This is...not simple. I agree that container networking is not all that much different from other Linux networking, but that doesn't make it simple. A lot of application developers are switching to working with containers and haven't historically had to do any manual network configuration. It's all new to them. Linux networking conventions change every few years and simplying keeping up with the basics is a chore. ne…

> netplan is the current flavor of the week ... for Ubuntu, and Ubuntu only. It is an invention of Canonical not adopted by the rest of Linux distros (except Ubuntu derivatives), generally speaking.

Long live wicked, easily managed with Yast on OpenSuse.

Re: Container networking is simple (2020)

#25

Post by jeffbee »

MaxBarraclough wrote: post #21
29athrowaway wrote: post #16

Earlier quoted context omitted.

Which defeats the purpose of containerization because now the container can sniff traffic on the host, hijack TCP connections, etc.

If you're running untrusted code in your container, you've pretty much already lost. Containers are useful for deployment and configuration, they are not a robustly secure sandbox. For that you still need to go with a VM. No cloud provider will offer to run your containers alongside other customer's containers, on a shared kernel. Your containers always run within your own VM.

I have to say, it would be cool if they did. If I could get a dirt-cheap rate for running batch workloads in a potentially antagonistic environment, I could make use of that. Not all data is sensitive.

Re: Container networking is simple (2020)

#26

Post by gorgoiler »

iximiuz wrote: post #20
gorgoiler wrote: post #10

Brilliant write up. Lots of this topic is so much easier to understand when it’s presented from first principles, without any of the LXC or Docker helpfulness hiding the details. (If the author is reading, thank you! I’ll likely use this material for the pupils in my computer club.) Managing an IPv6 stack alongside IPv4 is also very informative. IPv6 is still not widely deployed — SMTP is likely tied to v4 for all et…

Thank you very much for your feedback! I appreciate it a lot because at the end of the day that's what keeps me motivated!

The ip tool chain is a worthy thing to promote.

I especially like all of the replace verbs, which I wish I’d known about sooner. They make idempotency much simpler to express without any if ! ip thing get ; then ip add ; fi stuff.

Re: Container networking is simple (2020)

#27

Post by MaxBarraclough »

jeffbee wrote: post #25
MaxBarraclough wrote: post #21

Earlier quoted context omitted.

If you're running untrusted code in your container, you've pretty much already lost. Containers are useful for deployment and configuration, they are not a robustly secure sandbox. For that you still need to go with a VM. No cloud provider will offer to run your containers alongside other customer's containers, on a shared kernel. Your containers always run within your own VM.

I have to say, it would be cool if they did. If I could get a dirt-cheap rate for running batch workloads in a potentially antagonistic environment, I could make use of that. Not all data is sensitive.

It wouldn't save you that much compared to just going with a VM, especially if it's computationally intensive.

Re: Container networking is simple (2020)

#29

Post by kazen44 »

skrtskrt wrote: post #22
caymanjim wrote: post #12

This is...not simple. I agree that container networking is not all that much different from other Linux networking, but that doesn't make it simple. A lot of application developers are switching to working with containers and haven't historically had to do any manual network configuration. It's all new to them. Linux networking conventions change every few years and simplying keeping up with the basics is a chore. ne…

Any good books on Linux networking? I have started spinning up “bare metal” k8s on a cloud VM and it’s not that hard to get going until you get to anything networking related then I feel like I’ve just jumped off a cliff. I have no knowledge there and the online resources seem to be nonexistent because you’re expected to just use a prebaked solution from cloud providers. I ended up just installing k3s but I have yet…

To be fair, starting with something like a BSD might be easier in terms of networking. Mainly because the tooling hasn't been all over the place in the last 2 decades.

Also, a lot of network knowledge is not OS specific. Learning about IP, ethernet, routing protocols etc is valuable no matter which OS you use.

Re: Container networking is simple (2020)

#30

Post by skrtskrt »

kazen44 wrote: post #29
skrtskrt wrote: post #22

Earlier quoted context omitted.

Any good books on Linux networking? I have started spinning up “bare metal” k8s on a cloud VM and it’s not that hard to get going until you get to anything networking related then I feel like I’ve just jumped off a cliff. I have no knowledge there and the online resources seem to be nonexistent because you’re expected to just use a prebaked solution from cloud providers. I ended up just installing k3s but I have yet…

To be fair, starting with something like a BSD might be easier in terms of networking. Mainly because the tooling hasn't been all over the place in the last 2 decades. Also, a lot of network knowledge is not OS specific. Learning about IP, ethernet, routing protocols etc is valuable no matter which OS you use.

I have done some learning about more generalized network concepts (ip addresses, protocols, routing) but I want to make the jump to actually apply it in some VMs now

I think my next stop is the network section of Unix and Linux System Administration Handbook

Post reply on HN