Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker - the Linux container runtime

docker.io

Post reply on HN
Print view View original

111–120 of 209 posts

Re: Docker - the Linux container runtime

#111

Post by throwaway1979 »

price wrote: post #100
zobzu wrote: post #82

Note that LXC DOES NOT PROVIDE SECURITY. It provides resource separation (to a point) and so on. Breaking out of a filesystem container is as easy as creating a root block device. Breaking out of a network container is as easy as creating a network device And in all cases, you can just inject memory, load lkms, etc. That's without mentioning the amount of weekly CVEs for Linux namespaces.

> LXC DOES NOT PROVIDE SECURITY This is out of date. As of Linux 3.8, or with out-of-tree patches in older kernels, LXC puts each container in its own user namespace , so that root in the container has no privileges outside. LXC also uses network namespaces, so the user inside the container can only do on the network what the admin allows them to do. Because root inside a user namespace is unprivileged outside it, it…

Thank for your comment! I've been afflicted by FUD related to security in LXC for over a year. This really helps.

Re: Docker - the Linux container runtime

#114

Post by wereHamster »

I'm interested to see how that standardization works across linux distributions. I mean, different distros use different versions of various libraries (openssl for example). So if your app links with libssl.so.X but the host only provides libssl.so.Y, then your app won't work.

Of course, you could bundle libssl with your app. But then the standardization is at the level of kernel/libc ABI. In which case the container is basically a full LXC guest.

But then why standardize an image format if you can create a small script which builds the image with lxc-create + installs whatever else necessary for your app. That script will be much smaller than the full image, even a barebones ubuntu lxc guest (debootstrap quantal) is ~400MB.

Re: Docker - the Linux container runtime

#116

Post by noplay »

shykes wrote: post #30

Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!

Github: noplay

Thanks, that sound interesting

Re: Docker - the Linux container runtime

#117

Post by yebyen »

zimbatm wrote: post #83
shykes wrote: post #30

Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!

github/twitter: zimbatm I've built a similar tool using Go. Wondering how you guys get around the lack of clone(2) in the stdlib :)

I want to hear more about your go version of Docker. Link?

You have a lot of projects in your github repository and I was not able to identify it from scanning the list.

Re: Docker - the Linux container runtime

#118

Post by shykes »

NateDad wrote: post #115

Not to be a stick in the mud, but you're using a copyrighted image as your logo without any attribution or acknowledgement of the original owner of the copyright (the Lego Group). You should probably fix that.

You're right! We put it up there when it was an internal project, it's probably time to take care of that. Taking it down until we found a correct way to do it.

I'm a copyright noob: would simply acknowledging the copyright owner be enough and fall under fair use, or should we not use it unless we get written permission?

Re: Docker - the Linux container runtime

#119

Post by wslh »

laumars wrote: post #27
wslh wrote: post #17

Earlier quoted context omitted.

I am familiar with Microsoft App-V, VMWare ThinApp, and Symantec Workspace Virtualization. They can help you as a security sandbox but not as a full protection. A virtual machine will be much more secure (and theoretically very strong), although there are security bugs there that enable you to escape it. Those products work at two levels: using filtering drivers for registry and the filesystem, and hooking into the W…

Virtual machines are not more secure. In fact there's been more documented attacks where root access on a guest VM has gained shell access on the host, than there's been against containers. This doesn't mean that containers are more secure than VMs either. Attacking VMs attracts more security researchers from what I've seen (but I may be wrong on that point). However whether your running a container or a virtual mach…

Are you saying that both approaches have the same level of security or probable insecurities? or that you can't currently estimate the difference?

Even being aware that this is a Linux solution I mentioned the Windows technologies that I know technically.

Re: Docker - the Linux container runtime

#120

Post by davidwahler »

shykes wrote: post #30

Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!

I'd love to have access, thanks. My github username is dwahler.
Post reply on HN