Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
github: doda
Docker - the Linux container runtime
141–150 of 209 posts
Re: Docker - the Linux container runtime
#142I'm interested to see how that standardization works across linux distributions. I mean, different distros use different versions of various libraries (openssl for example). So if your app links with libssl.so.X but the host only provides libssl.so.Y, then your app won't work. Of course, you could bundle libssl with your app. But then the standardization is at the level of kernel/libc ABI. In which case the container…
Their base layer needs to specify exact versions of libraries.
Deploying from images should be much faster and less fragile (oops, is Github down?) than from scripts.
Re: Docker - the Linux container runtime
#143Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
github id: stormbrew
I've been wondering when something like this would come around and if I'd have to try to write it myself. I've made smaller, less isolated, scale versions of this idea before but this looks snazzy.
Re: Docker - the Linux container runtime
#144Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
github: thoward
How does this compare with warden? https://github.com/thoward/vagrant-warden
Re: Docker - the Linux container runtime
#145Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
github: baransn
Re: Docker - the Linux container runtime
#146Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
github: thoward How does this compare with warden? https://github.com/thoward/vagrant-warden
BTW: If you're doing beta access, I could use this immediately for http://riakon.com .. Currently using something I hacked together w/ warden, but Docker looks like a more elegant solution (and I'd rather be part of a community than using my own one-off hack).
Re: Docker - the Linux container runtime
#147Earlier quoted context omitted.
Container based virtualization can provide an impressive amount of isolation while improving density dramatically on light duty loads over virtualization. Solaris zones are very well regarded and are used for multi-tenant by Joyent, and many many linux hosts provide multi-tenant solutions based on virtuozzo which predates linux containers by a good number of years. The main theoretical difference between hypervisor i…
Solaris zones use similar concepts to LXC/namespaces, but are actually providing secure isolation. Recent patches DO NOT provide "full isolation" and never did. What they add is usermode containers. Those are broken weekly since the release. Seriously. Have a look at http://blog.gmane.org/gmane.comp.security.oss.general
> Those are broken weekly since the release. Seriously.
> Have a look at http://blog.gmane.org/gmane.comp.security.oss.general
Funny you should say that. The latest virtualization-related CVEs there are actually in KVM -- a trio including two host memory corruptions, which usually enables completely owning the host. http://permalink.gmane.org/gmane.comp.security.oss.general/9...
And on the other hand, I don't see any container-related CVEs at all from 2013 in the CVE database: http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=linux+kernel (The KVM issues I mentioned don't show up yet either, because they're from today.) What vulnerabilities are you referring to?
Maybe you mean kernel vulnerabilities in general, some of which could be usable by a user inside a container. Everyone should stay on top of kernel updates in any event. If you hate the rebooting, Ksplice is free for Ubuntu (and Fedora.)
Re: Docker - the Linux container runtime
#148I'm interested to see how that standardization works across linux distributions. I mean, different distros use different versions of various libraries (openssl for example). So if your app links with libssl.so.X but the host only provides libssl.so.Y, then your app won't work. Of course, you could bundle libssl with your app. But then the standardization is at the level of kernel/libc ABI. In which case the container…
Their base layer needs to specify exact versions of libraries. Deploying from images should be much faster and less fragile (oops, is Github down?) than from scripts.
Absolutely. Think of a Docker container as a universal build artifact. Your build step can be an arbitrary sequence of unix commands (download dependencies, build libssl, run shell scripts etc.). Docker can freeze the result of that build and guarantee that it will run in a repeatable and self-contained way, no matter where you run it.
So you get clean separation of build and run, which is a hugely important part of reliable deployment.
Re: Docker - the Linux container runtime
#149Wow! Did not expect this to show up on HN before actual release! (I work at dotCloud). We're still polishing a few rough edges. If you want early access add your github ID to this thread and we'll add you right away!
wow. github: seletz
Re: Docker - the Linux container runtime
#150Earlier quoted context omitted.
Virtual machines are not more secure. In fact there's been more documented attacks where root access on a guest VM has gained shell access on the host, than there's been against containers. This doesn't mean that containers are more secure than VMs either. Attacking VMs attracts more security researchers from what I've seen (but I may be wrong on that point). However whether your running a container or a virtual mach…
Are you saying that both approaches have the same level of security or probable insecurities? or that you can't currently estimate the difference? Even being aware that this is a Linux solution I mentioned the Windows technologies that I know technically.
> Are you saying that both approaches have the same level of security or probable insecurities? or that you can't currently estimate the difference?
A bit of both, but mostly the former. In practical terms, they both have the same level of security. But -as with any software- something could be published tomorrow exposing some massive flaw that totally blows one or the other out of the water. However neither offer any technical advantage over the other from a security stand point and from a practical perspective, the real question of security is whether your guest OSs are locked down to begin with (eg it's no good arguing which home security system is the most effective if you leave the front door open to begin with).
> Even being aware that this is a Linux solution I mentioned the Windows technologies that I know technically.
That's fair enough and I had suspected that was the case. I just wanted to make sure that we were both talking about the same thing :)