Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Container networking is simple (2020)

iximiuz.com

Post reply on HN
Print view View original

41–50 of 68 posts

Re: Container networking is simple (2020)

#41

Post by a1369209993 »

iximiuz wrote: post #19
Hackbraten wrote: post #14

Earlier quoted context omitted.

I think it’s time for us to get past “X is simple” or “X is easy.” It’s a highly subjective thing to say, no matter the topic. It’s never helpful, it just makes other people feel bad.

Well, to be honest, some level of sarcasm was meant to be in this title because it precedes a 4000+ words explanation of the topic... But seems like I'm pretty bad at writing good titles. For sure I didn't mean to make anyone feel bad.

FWIW, I thought it was obviously either stupidity[0] or sarcasm based on the title, and the 4000+ words explanation confirmed it as the latter. Can't speak for anyone else, though.

Edit: 0: well, or lies / container vendor shilling

Re: Container networking is simple (2020)

#42

Post by Hackbraten »

iximiuz wrote: post #19
Hackbraten wrote: post #14

Earlier quoted context omitted.

I think it’s time for us to get past “X is simple” or “X is easy.” It’s a highly subjective thing to say, no matter the topic. It’s never helpful, it just makes other people feel bad.

Well, to be honest, some level of sarcasm was meant to be in this title because it precedes a 4000+ words explanation of the topic... But seems like I'm pretty bad at writing good titles. For sure I didn't mean to make anyone feel bad.

Appreciate the response. Thank you.

Re: Container networking is simple (2020)

#43

Post by caymanjim »

kenniskrag wrote: post #34
caymanjim wrote: post #12

This is...not simple. I agree that container networking is not all that much different from other Linux networking, but that doesn't make it simple. A lot of application developers are switching to working with containers and haven't historically had to do any manual network configuration. It's all new to them. Linux networking conventions change every few years and simplying keeping up with the basics is a chore. ne…

> through your firewall in non-obvious ways. People don't realize that with a default Docker configuration, containers are ignoring any normal firewall rules you may have setup with iptables or ufw. What do you mean by non-obvious? If I bind a port of the container to the host eg. -p 8080:80 only this port is a hole. Do you have something different in mind? (I'm a docker beginner)

That alone is non-obvious. Docker adds prerouting and masquerade changes. They don't show up in the default iptables rule list (iptables -L). If you don't know about it creating the other tables it adds, and how to list them explicitly, you won't see these rules added. Docker binds to the public interface by default, rather than to much-safer private/localhost defaults. If you have an iptables INPUT DENY rule, it doesn't come into play at all, and that's certainly untuitive for people who aren't iptables experts. For example, if you're using ufw (which most non-power-users rely on) and have it set to DENY by default, that won't protect you from the example you provided. The way Docker works is simply wrong. It should not mess with iptables at all. It does so because that makes it "easier" for novice users, but that ease of use is a real security risk.

Re: Container networking is simple (2020)

#44

Post by tiew9Vii »

kazen44 wrote: post #29
skrtskrt wrote: post #22

Earlier quoted context omitted.

Any good books on Linux networking? I have started spinning up “bare metal” k8s on a cloud VM and it’s not that hard to get going until you get to anything networking related then I feel like I’ve just jumped off a cliff. I have no knowledge there and the online resources seem to be nonexistent because you’re expected to just use a prebaked solution from cloud providers. I ended up just installing k3s but I have yet…

To be fair, starting with something like a BSD might be easier in terms of networking. Mainly because the tooling hasn't been all over the place in the last 2 decades. Also, a lot of network knowledge is not OS specific. Learning about IP, ethernet, routing protocols etc is valuable no matter which OS you use.

I agree.

I've had years of Linux experience and decided my home network + router was quite poor and I'd set up my own home network router and use OpenBSD to do it as an excuse to look at a BSD and fix my network issues.

OpenBSD has been an absolute pleasure to work with. The man pages are well written and complete, the filesystem is well organized, having no issues that people have with Systemd the simplicity of OpenBSD's init system showed you don't need complex init systems. Then you have PF which is far easier to deal with than IP tables.

It took me a few hours of playing to set OpenBSD up with multiple vlan's, dhcp server, firewall, cross vlan routing, mdns etc. The hardest part was figuring out the correct parameters for my ISP broadband connection as the ISP didn't publish some of the information so needed to sniff the network traffic to find that i needed to set a vlan for my isp.

The simplicity of OpenBSD makes it very easy to learn networking and if you are familiar with Linux you will become familiar with BSD very quickly as BSD's are less fragmented than Linux by their nature.

Re: Container networking is simple (2020)

#45

Post by john-tells-all »

gorgoiler wrote: post #26
iximiuz wrote: post #20

Earlier quoted context omitted.

Thank you very much for your feedback! I appreciate it a lot because at the end of the day that's what keeps me motivated!

The ip tool chain is a worthy thing to promote. I especially like all of the replace verbs, which I wish I’d known about sooner. They make idempotency much simpler to express without any if ! ip thing get ; then ip add ; fi stuff.

That's cool! Here's a synopsis of `ip replace`: "replace will either modify an existing address or create a new one if the specified address does not exist"

https://serverfault.com/questions/476926/understanding-ip-ad...

Re: Container networking is simple (2020)

#46

Post by __turbobrew__ »

tiew9Vii wrote: post #44
kazen44 wrote: post #29

Earlier quoted context omitted.

To be fair, starting with something like a BSD might be easier in terms of networking. Mainly because the tooling hasn't been all over the place in the last 2 decades. Also, a lot of network knowledge is not OS specific. Learning about IP, ethernet, routing protocols etc is valuable no matter which OS you use.

I agree. I've had years of Linux experience and decided my home network + router was quite poor and I'd set up my own home network router and use OpenBSD to do it as an excuse to look at a BSD and fix my network issues. OpenBSD has been an absolute pleasure to work with. The man pages are well written and complete, the filesystem is well organized, having no issues that people have with Systemd the simplicity of Open…

I was amazed when my OpenBSD network config worked on the first try using only the man pages as reference.

On the other hand it took me the better part of an hour to figure out how to change the DNS server used by an Ubuntu install.

Re: Container networking is simple (2020)

#48

Post by cpuguy83 »

jeffbee wrote: post #25
MaxBarraclough wrote: post #21

Earlier quoted context omitted.

If you're running untrusted code in your container, you've pretty much already lost. Containers are useful for deployment and configuration, they are not a robustly secure sandbox. For that you still need to go with a VM. No cloud provider will offer to run your containers alongside other customer's containers, on a shared kernel. Your containers always run within your own VM.

I have to say, it would be cool if they did. If I could get a dirt-cheap rate for running batch workloads in a potentially antagonistic environment, I could make use of that. Not all data is sensitive.

It is how Heroku has operated since forever. Containers can be secure.

Re: Container networking is simple (2020)

#49

Post by m463 »

29athrowaway wrote: post #16
m463 wrote: post #4

It is if you use: --net=host

Which defeats the purpose of containerization because now the container can sniff traffic on the host, hijack TCP connections, etc.

I believe the purpose of containers is different for different people. build vs deploy.

Re: Container networking is simple (2020)

#50

Post by jasonjayr »

caymanjim wrote: post #12

This is...not simple. I agree that container networking is not all that much different from other Linux networking, but that doesn't make it simple. A lot of application developers are switching to working with containers and haven't historically had to do any manual network configuration. It's all new to them. Linux networking conventions change every few years and simplying keeping up with the basics is a chore. ne…

> Linux networking conventions change every few years and simplying keeping up with the basics is a chore.

Debian has used /etc/network/interfaces for as long as I know. (at least 15+ years) It's sane, short and straightforward. For servers, this has been more than ideal for every setup I could conceive.

Post reply on HN