Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
github: jackinloadup
Docker - the Linux container runtime
121–130 of 209 posts
Re: Docker - the Linux container runtime
#122Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
Sounds promising.
Github: dvbportal
Re: Docker - the Linux container runtime
#123Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
github: robertfw
Re: Docker - the Linux container runtime
#124So what we have here is a presently-closed-source, linux-only implementation of closure copying, which is a tiny part of Nix, which is the platform-agnostic package manager behind the elegant NixOS (nixos.org). Or is there something I'm not getting? If it's more platform-dependent, less well-tested, and (ostensibly temporarily) less open, then why is this on the top of my page?
Re: Docker - the Linux container runtime
#125Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
github: wiredfool
Re: Docker - the Linux container runtime
#126Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
I've also been building something similar to docker by plugging into Puppet, Jenkins and ActiveMQ. Would love to take a looker at Docker. I'm http://github.com/georgebashi
Re: Docker - the Linux container runtime
#127So what we have here is a presently-closed-source, linux-only implementation of closure copying, which is a tiny part of Nix, which is the platform-agnostic package manager behind the elegant NixOS (nixos.org). Or is there something I'm not getting? If it's more platform-dependent, less well-tested, and (ostensibly temporarily) less open, then why is this on the top of my page?
As a fan of Nix, and someone who expected a lot from Conary/rPath back in the day, I can provide at least a partial answer: these distros are great as long as you use their packaging tools for everything. Which is simply not practical. There's a reason Nix and rPath never took off, and it's the same reason developers use virtualenv and rvm instead of system packages. They don't like being forced to use a single packaging tool for everything.
Docker doesn't have an opinion about how you package things. It only cares about the resulting changes on the filesystem. So you are free to use the best tool for each job.
By the way this means you can use Docker and Nix together. I would love to see that :)
Re: Docker - the Linux container runtime
#128Note that LXC DOES NOT PROVIDE SECURITY. It provides resource separation (to a point) and so on. Breaking out of a filesystem container is as easy as creating a root block device. Breaking out of a network container is as easy as creating a network device And in all cases, you can just inject memory, load lkms, etc. That's without mentioning the amount of weekly CVEs for Linux namespaces.
> LXC DOES NOT PROVIDE SECURITY This is out of date. As of Linux 3.8, or with out-of-tree patches in older kernels, LXC puts each container in its own user namespace , so that root in the container has no privileges outside. LXC also uses network namespaces, so the user inside the container can only do on the network what the admin allows them to do. Because root inside a user namespace is unprivileged outside it, it…
And apparmor is not LXC.
Indeed, if you use apparmor to further restrict LXC you can some kind of security (as long as there isn't a new CVE every week that is).
Re: Docker - the Linux container runtime
#129Earlier quoted context omitted.
you're trying to justify the use of lxc for security, IMO. Your webpage does state "strong guarantees of isolation" if you're sharing nothing of importance on the host, then, you don't really need LXC, unless you don't know how to setup mysql with more than one database, nginx with more than one virtual host, yada yada. Here's the trick: you CAN use LXC and SUPPLEMENT it by something providing security such as SELinu…
dotCloud engineer here. LXC lets you use cgroups, i.e. setup memory/cpu/IO limits per container. If you setup MySQL with more than database, you can't do that. Also, we DO use LXC and SUPPLEMENT it by something providing security such as GRSEC (in the current version in production at dotCloud) and AppArmor (with docker) :-)
you can actually use cgroups without lxc, btw.
if you do use apparmor and grsec (as in RBAC's part of grsec in particular) it's probably acceptable, but I haven't seen it mentioned on the website - and people figure, they'll just use lxc "and be safe".
Re: Docker - the Linux container runtime
#130Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
There was a lightning talk about Docker at Pycon; I'd assume that's where OP got the info from :)
That's possible. When we submitted the lightning talk, we pictured a poorly lit backroom with maybe 15 fellow kernel geeks. Instead, we presented in the main room to at least 500 people... So much for discreetly asking for feedback :)