Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker 0.7 runs on all Linux distributions

blog.docker.io

Post reply on HN
Print view View original

31–40 of 131 posts

Re: Docker 0.7 runs on all Linux distributions

#31

Post by yebyen »

Sprint wrote: post #14

I looked at it several times but never really got it. Can I use Docker to isolate different servers (think http, xmpp, another http on another port) on a server so that if one of them was exploited, the attacker would be constrained to inside the container? Or is it "just" of a convenient way to put applications into self-contained packages?

I have heard two opinions. One of them is paranoid: "if you give up root on the container you give up root on the host system." I am not sure I believe this, I can't show you how to do the compromise and escalation, but I know there is a -privileged mode you can use on your containers in which Root user can do things like create device nodes, reset the system clock, and presumably other things you should not allow if you are concerned about this kind of attack.

The other opinion (given that you don't enable -privileged mode) is that lxc namespaces _do_ protect your host and other containers from being exploited due to compromise of a contained process, and cgroups _do_ protect your precious i/o and cpu cycles from being fully consumed and deadlocking your whole system when a rogue container decides to start infinite looping.

The competent answer of course is "try it", you should know that there are ways your processes can be compromised, and you should check if the exploits you know about result in the same or different privilege escalations when you apply them to a service hosted within a docker instance. That being said, you can't really prove a negative...

Re: Docker 0.7 runs on all Linux distributions

#32

Post by jebblue »

mateuszf wrote: post #26
neals wrote: post #9

I see docker come around every now and then here. I'm a smalltime developer shop, small team, small webspps. What can docker do for me? Can this reduce the time it takes me to put up and Ubuntu installation on Digital Ocean? Is this more for larger companies ?

You will be able to have multiple Ubuntu servers running on one Ubuntu VPS on Digital Ocean. Each of them may have some initial state (installed some software, configuration) that you will be able to spawn as separate virtual machine. The "inside" machine will consume mnimal amount of memory (for running applications) and not for whole OS as in case of "real virtual machine". Also, you will be able to spawn and destr…

Is it an easier to use chroot? Because I'd just use chroot if I wanted that or maybe openvz. Or just spin up a virtual node dedicated to the task I need it to perform.

Re: Docker 0.7 runs on all Linux distributions

#34

Post by julien421 »

yebyen wrote: post #31
Sprint wrote: post #14

I looked at it several times but never really got it. Can I use Docker to isolate different servers (think http, xmpp, another http on another port) on a server so that if one of them was exploited, the attacker would be constrained to inside the container? Or is it "just" of a convenient way to put applications into self-contained packages?

I have heard two opinions. One of them is paranoid: "if you give up root on the container you give up root on the host system." I am not sure I believe this, I can't show you how to do the compromise and escalation, but I know there is a -privileged mode you can use on your containers in which Root user can do things like create device nodes, reset the system clock, and presumably other things you should not allow if…

This is maybe part of the answer on the security point http://blog.docker.io/2013/08/containers-docker-how-secure-a...

Re: Docker 0.7 runs on all Linux distributions

#35

Post by alexlarsson »

T-zex wrote: post #17

Is it possible to have multiple instances of the same app running in Docker containers and having readonly access to a "global" memory linked file? What I'm trying to achieve is having sand-boxed consumers having access to some shared resource.

Use the volumes feature to share a filesystem between multiple containers

Re: Docker 0.7 runs on all Linux distributions

#36

Post by dman »

mateuszf wrote: post #26
neals wrote: post #9

I see docker come around every now and then here. I'm a smalltime developer shop, small team, small webspps. What can docker do for me? Can this reduce the time it takes me to put up and Ubuntu installation on Digital Ocean? Is this more for larger companies ?

You will be able to have multiple Ubuntu servers running on one Ubuntu VPS on Digital Ocean. Each of them may have some initial state (installed some software, configuration) that you will be able to spawn as separate virtual machine. The "inside" machine will consume mnimal amount of memory (for running applications) and not for whole OS as in case of "real virtual machine". Also, you will be able to spawn and destr…

What does the vm abstraction buy you vs processes? If one entity "owns" all the servers what is the draw in seperating the servers out in their own VM?

Re: Docker 0.7 runs on all Linux distributions

#37

Post by shykes »

mateuszf wrote: post #21
shykes wrote: post #2

A few details on the "standard linux support" part. To remove the hard dependency on the AUFS patches, we moved it to an optional storage driver, and shipped a second driver which uses thin LVM snapshots (via libdevmapper) for copy-on-write. The big advantage of devicemapper/lvm, of course, is that it's part of the mainline kernel. If your system supports AUFS, Docker will continue to use the AUFS driver. Otherwise i…

Does the LVM part mean that the partition/disk used to store/run Docker images has to use LVM?

No, docker sets up its own partition in a loop-mounted sparse file. There is a slight performance tradeoff, but in production you should assume the copy-on-write layer is too slow anyway and use volumes for your performance-critical directories: http://docs.docker.io/en/master/use/working_with_volumes/

In the future the drivers should support using actual lvm-enabled devices if you have them.

Re: Docker 0.7 runs on all Linux distributions

#38

Post by alexlarsson »

m_mueller wrote: post #25
shykes wrote: post #15

Earlier quoted context omitted.

The 42 layer limit is still there... But not for long! There is a fix underway to remove the limitation from all drivers, including aufs. Instead of lifting the limit for some drivers first (which would mean some images on the index could only be used by certain drivers - something we really want to avoid), we're artificially enforcing the limit on all drivers until it can be lifted altogether. If you want to follow…

One thing I've been wondering is whether the 42 limit was related to performance considerations. If yes, I actually somewhat like it - I'm a proponent to making systems behave in a way that they won't come around and bite you. Will a container based on, say, 200 layers still load and run with reasonable performance?

That depends on the backend a bit i guess. devicemapper "flattens" each layer, so the depth should have zero effect on the performance.

For aufs, I have no real data, but I assume that a 42 layer image is somewhat slower than a 1 layer image.

The fix for going to > 42 layers is to recreate a full image snapshot (using hard links to share file data) every N layers, so the performance would be somewhere between the performance between 1 and 42 layers depending on how many AUFS layers you got.

Re: Docker 0.7 runs on all Linux distributions

#39

Post by shykes »

jebblue wrote: post #32
mateuszf wrote: post #26

Earlier quoted context omitted.

You will be able to have multiple Ubuntu servers running on one Ubuntu VPS on Digital Ocean. Each of them may have some initial state (installed some software, configuration) that you will be able to spawn as separate virtual machine. The "inside" machine will consume mnimal amount of memory (for running applications) and not for whole OS as in case of "real virtual machine". Also, you will be able to spawn and destr…

Is it an easier to use chroot? Because I'd just use chroot if I wanted that or maybe openvz. Or just spin up a virtual node dedicated to the task I need it to perform.

It is definitely designed to be easier in several ways. One way is that it defines a format for portable container images, and an infrastructure for moving images around machines and sharing them with others. See http://www.docker.io/gettingstarted/ for an online tutorial and https://index.docker.io for the index of all community images.

Re: Docker 0.7 runs on all Linux distributions

#40

Post by shykes »

sown wrote: post #33

Hey, docker newb here. Can I easily put my own software in it? I've got this c++ program that has a few dependencies in ubuntu.

The easiest way is to add a Dockerfile to your source repository, and use 'docker build' to create a container image from it.

Documentation link: http://docs.docker.io/en/master/use/builder/

Post reply on HN