Docker - the Linux container runtime • Hacker News Board

Re: Docker - the Linux container runtime

#81

Post by menage » Wed, Mar 20, 2013, 6:14 PM UTC

teraflop wrote: post #20

derefr wrote: post #9

Earlier quoted context omitted.

> The Linux namespace stuff is evolving pretty fast, and I personally wouldn't trust it as the main line of defense for anything important. If I recall, Heroku uses cgroups (EDIT: and namespaces) exclusively for multitenant isolation (and by the looks of this, dotCloud does too), so that's two big votes in the "if it's good enough for them" category.

Sure, but cgroups and namespaces are kind-of-orthogonal features that both happen to be useful for making container-like things. cgroups are for limiting resource usage; namespaces are for providing the illusion of root access while actually being in a sandboxed environment. And as far as I'm aware (speaking as an interested non-expert, so please correct me if I'm wrong) cgroups have no effect on permissions, whereas…

Fundamentally, the cgroups framework is just a way of creating some arbitrary kernel state and associating a set of processes with that state. For most cgroup subsystems, the kernel state is something to do with resource usage, but it can be used for anything that the cgroup subsystem creator wants. At least one subsystem (the devices cgroup) provides security (by controlling which device ids processes in that cgroup can access) rather than resource usage limiting.

Re: Docker - the Linux container runtime

#82

Post by zobzu » Wed, Mar 20, 2013, 6:14 PM UTC

Note that LXC DOES NOT PROVIDE SECURITY. It provides resource separation (to a point) and so on.

Breaking out of a filesystem container is as easy as creating a root block device. Breaking out of a network container is as easy as creating a network device

And in all cases, you can just inject memory, load lkms, etc. That's without mentioning the amount of weekly CVEs for Linux namespaces.

Re: Docker - the Linux container runtime

#83

Post by zimbatm » Wed, Mar 20, 2013, 6:15 PM UTC

shykes wrote: post #30

Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!

github/twitter: zimbatm

I've built a similar tool using Go. Wondering how you guys get around the lack of clone(2) in the stdlib :)

Re: Docker - the Linux container runtime

#84

Post by shykes » Wed, Mar 20, 2013, 6:16 PM UTC

zobzu wrote: post #82

Note that LXC DOES NOT PROVIDE SECURITY. It provides resource separation (to a point) and so on. Breaking out of a filesystem container is as easy as creating a root block device. Breaking out of a network container is as easy as creating a network device And in all cases, you can just inject memory, load lkms, etc. That's without mentioning the amount of weekly CVEs for Linux namespaces.

(Copying my answer to a similar question)

Yes, you probably don't want to run untrusted code with root privileges inside a container if anything valuable is running on the same host.

However if that code is trusted, or if you're running it as an unprivileged user, or if nothing else of importance is sharing the same host, then I would not hesitate to use them.

Containers are awesome because they represent a logical component in your software stack. You can also use them as a unit of hardware resource allocation and multi-tenancy, but you don't have to: you can map a container 1-to-1 to a physical box, for example. But the logical unit remains the same regardless of the underlying hardware and multi-tenancy setup, which is truly awesome.

EDIT: details on multi-tenancy.

Re: Docker - the Linux container runtime

#85

Post by zobzu » Wed, Mar 20, 2013, 6:16 PM UTC

trotsky wrote: post #29

asadjb wrote: post #4

I'm not familiar with any of the technologies used in this. Anybody care to comment on how strong the isolations would be security wise, compared to normal virtualization? If the security is almost at par and the isolation is good enough that one bad process can't bring the whole system down, might this be a good alternative to virtualization, since I imagine it would definitely use less resources.

Container based virtualization can provide an impressive amount of isolation while improving density dramatically on light duty loads over virtualization. Solaris zones are very well regarded and are used for multi-tenant by Joyent, and many many linux hosts provide multi-tenant solutions based on virtuozzo which predates linux containers by a good number of years. The main theoretical difference between hypervisor i…

Solaris zones use similar concepts to LXC/namespaces, but are actually providing secure isolation.

Recent patches DO NOT provide "full isolation" and never did. What they add is usermode containers. Those are broken weekly since the release. Seriously. Have a look at http://blog.gmane.org/gmane.comp.security.oss.general

Re: Docker - the Linux container runtime

#86

Post by shykes » Wed, Mar 20, 2013, 6:16 PM UTC

zobzu wrote: post #82

Note that LXC DOES NOT PROVIDE SECURITY. It provides resource separation (to a point) and so on. Breaking out of a filesystem container is as easy as creating a root block device. Breaking out of a network container is as easy as creating a network device And in all cases, you can just inject memory, load lkms, etc. That's without mentioning the amount of weekly CVEs for Linux namespaces.

(Copying my answer to a similar question)

Yes, you probably don't want to run untrusted code with root privileges inside a container if anything valuable is running on the same host.

However if that code is trusted, or if you're running it as an unprivileged user, or if nothing else of importance is sharing the same host, then I would not hesitate to use them.

Containers are awesome because they represent a logical component in your software stack. You can also use them as a unit of hardware resource allocation and multi-tenancy, but you don't have to: you can map a container 1-to-1 to a physical box, for example. But the logical unit remains the same regardless of the underlying hardware and multi-tenancy setup, which is truly awesome.

EDIT: details on multi-tenancy.

Re: Docker - the Linux container runtime

#87

Post by shykes » Wed, Mar 20, 2013, 6:18 PM UTC

peterwwillis wrote: post #70

shykes wrote: post #59

Earlier quoted context omitted.

Hi Peter, this website was only meant to be seen once Docker is actually open-source, which will be the case very soon. I do think there is a need for a standard way to package and share software at the filesystem and process level - we don't pretend to define that standard, but hopefully we can contribute to it by open-sourcing a real-world implementation.

I guess I read too far into it when I saw the word "standard" everywhere and got excited - sorry about that. Do you plan on adding to your implementation the ability to differentiate between compatible versions/platforms, so one could use this on several cloud instances that aren't built the same?

Yes, that is definitely something we would like to add. And we will gladly accept pull requests :)

Re: Docker - the Linux container runtime

#88

Post by zobzu » Wed, Mar 20, 2013, 6:20 PM UTC

shykes wrote: post #84

zobzu wrote: post #82

Note that LXC DOES NOT PROVIDE SECURITY. It provides resource separation (to a point) and so on. Breaking out of a filesystem container is as easy as creating a root block device. Breaking out of a network container is as easy as creating a network device And in all cases, you can just inject memory, load lkms, etc. That's without mentioning the amount of weekly CVEs for Linux namespaces.

(Copying my answer to a similar question) Yes, you probably don't want to run untrusted code with root privileges inside a container if anything valuable is running on the same host. However if that code is trusted, or if you're running it as an unprivileged user, or if nothing else of importance is sharing the same host, then I would not hesitate to use them. Containers are awesome because they represent a logical c…

you're trying to justify the use of lxc for security, IMO. Your webpage does state "strong guarantees of isolation"

if you're sharing nothing of importance on the host, then, you don't really need LXC, unless you don't know how to setup mysql with more than one database, nginx with more than one virtual host, yada yada.

Here's the trick: you CAN use LXC and SUPPLEMENT it by something providing security such as SELinux.

Re: Docker - the Linux container runtime

#89

Post by shykes » Wed, Mar 20, 2013, 6:20 PM UTC

theatrus2 wrote: post #65

Whats the interaction between systems based on Mesos, which can (and many do) use containers? Is this really designed for more multi-tenancy with lower trust over same-org clouds?

Docker solves the problem of running things in a repeatable and infrastructure-agnostic way. Mesos solves the problem of telling many nodes what to run and when.

In other words, Docker + Mesos is a killer combo. There is already experimentation underway to use Docker as an execution engine for Mesos.

Re: Docker - the Linux container runtime

#90

Post by Tobu » Wed, Mar 20, 2013, 6:21 PM UTC

shykes wrote: post #30

Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!

Oooh! Tobu. edit: building, thanks!