Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker 0.7 runs on all Linux distributions

blog.docker.io

Post reply on HN
Print view View original

121–130 of 131 posts

Re: Docker 0.7 runs on all Linux distributions

#121

Post by yebyen »

dmunoz wrote: post #87
yebyen wrote: post #84

Earlier quoted context omitted.

Yes, I wrote a long wordy response and neglected to mention "docker start" which is a perfectly good way to come back to a stopped container after the first "docker run". I prefer to never keep anything important in a stopped container (for very long) without committing it back to an image, and I don't like dealing with numeric ids. Recently (it looks like you don't have this change yet) docker added the automatic na…

Indeed, if I had done anything important I would certainly commit the changes to the container. It's great to have some version control for my playful discovery. The changes you mention sound nice. It's no surprise I don't have them: root@chris-VM:~# docker version Client version: 0.5.3 Server version: 0.5.3 Go version: go1.1 It was the easiest VM I had access to at the moment of posting. I should update the docker i…

If you hadn't heard, the new release of docker no longer uses "color_animal" but "mood_inventor"... "the most important new feature of docker 0.7"

https://github.com/dotcloud/docker/pull/2837

tl;dr They are going to pick a new pair of things for every major release of Docker. This is meant to let you keep track of more containers over a long time. Apparently you are in fact meant to keep them around if they're still in working order, and remember them "by ID" or by name.

Re: Docker 0.7 runs on all Linux distributions

#122

Post by justincormack »

salient wrote: post #61
shykes wrote: post #13

Earlier quoted context omitted.

Not yet, but that's coming very soon. We've been artificially limiting the number of architectures supported to limit the headache of managing cross-arch container images. We're reaching the point where that will no longer be a problem - meanwhile the Docker on Raspberry Pi community is growing restless and we want to make them happy :)

For your sake, you better hope there won't be another ARMv7 and also ARMv8 version of Raspberry Pi, too :)

Well, these things exist not raspberry pies. ARM architectures are a pain. Like x86 ones were in the old days (i386, i486). MIPS is even worse.

Re: Docker 0.7 runs on all Linux distributions

#123

Post by justincormack »

shykes wrote: post #88
throwaway092834 wrote: post #86

Earlier quoted context omitted.

Yes, it is trivial for a root user in an LXC container to break out. One can load a kernel module from within a container, for example. LXC containers do not provide security partitioning at all.

This is just totally wrong. Any decent container configuration (including the default docker configuration) will agressively drop capabilities, preventing you from doing this, and any other script-kiddie attack. See my other comment in this thread for a more accurate answer.

Yes, you probably need a proper kernel vulnerability, which you can exploit in a reduced environment. Not trivial, but not impossible, scanning this years CVEs some would probably be sufficient (eg ones that only nees socket access).

Re: Docker 0.7 runs on all Linux distributions

#124

Post by justincormack »

Xelom wrote: post #42

Will it be possible to run Docker containers on Android? I may be asking this incorrectly. So correct me if I have a mistake. My question might be "Will it be possible to run Docker containers on Dalvik VM?" or "Can I run an Android in Docker container?"

You cant "run docker on Dalvik VM" as it runs on Linux not on a JVM. You also can't run Android on a Docker container as Android needs some system calls not in a standard Linux kernel, although there may be some ways around that.

You might be able to run docker on Android though, but you may need to compile a kernel with containers (namespace) support as I don't know that Android ships with them (I forget).

Re: Docker 0.7 runs on all Linux distributions

#125

Post by alanthing »

jackielii wrote: post #117
Nux wrote: post #53

EL6 users (RHEL, CentOS, SL), I've just learned Docker is now in EPEL (testing for now, but will hit release soon): yum --enablerepo=epel-testing install docker-io PS: make sure you have "cgconfig" service running

Hmm. Thanks for this, but I couldn't find package "docker-io" in epel-testing. Could you post a detailed instruction? Thanks a lot!

Looks like it was pulled- I can't find it on any EPEL mirrors.

Re: Docker 0.7 runs on all Linux distributions

#126

Post by peterwwillis »

shykes wrote: post #104
peterwwillis wrote: post #101

Earlier quoted context omitted.

When you try to run an executable on an architecture it wasn't designed for, it does not run. But this has nothing to do with docker or Linux.

This, by the way, is the reason we artificially prevent docker from running on multiple archs. If half of the containers you download end up not running on your arch, and there's no elegant way for you to manage that by filtering your results, and producing the same build for multiple archs (and what does it even mean to do that?) - then all of sudden using docker would become much more frustrating.

This sounds like a clothing manufacturer who only makes clothes in black because trying to match colors would be too frustrating for customers. At the end of the day, lots of people have multiarch networks, and don't want to have to choose between using a tool or supporting just one platform. Removing functionality does not make their lives easier.

Re: Docker 0.7 runs on all Linux distributions

#127

Post by vivab0rg »

tbrock wrote: post #110
fosk wrote: post #108

Earlier quoted context omitted.

I'm new to these tools. Given your explanation, how does Docker replace a packaged Vagrant machine[0] with all the software already pre-installed (without using Chef)? [0] http://docs.vagrantup.com/v2/cli/package.html

Much lighter weight. Instead of hosting an entire operating system you just host the application. Imagine spinning up your db instance vm, your web tier vm, your load balancer vm... etc. Unless you have a ton of ram it isn't going to happen. With docker you can run containers that mimick a very very large infrastructure on your laptop.

What about using Vagrant with the [vagrant-lxc plugin](http://fabiorehm.com/blog/2013/04/28/lxc-provider-for-vagran...)?

Re: Docker 0.7 runs on all Linux distributions

#128

Post by riquito »

justincormack wrote: post #123
shykes wrote: post #88

Earlier quoted context omitted.

This is just totally wrong. Any decent container configuration (including the default docker configuration) will agressively drop capabilities, preventing you from doing this, and any other script-kiddie attack. See my other comment in this thread for a more accurate answer.

Yes, you probably need a proper kernel vulnerability, which you can exploit in a reduced environment. Not trivial, but not impossible, scanning this years CVEs some would probably be sufficient (eg ones that only nees socket access).

Can't you take advantage of a kernel vulnerability on any reduced environment, regardless of LXC?

Re: Docker 0.7 runs on all Linux distributions

#129

Post by throwaway092834 »

riquito wrote: post #128
justincormack wrote: post #123

Earlier quoted context omitted.

Yes, you probably need a proper kernel vulnerability, which you can exploit in a reduced environment. Not trivial, but not impossible, scanning this years CVEs some would probably be sufficient (eg ones that only nees socket access).

Can't you take advantage of a kernel vulnerability on any reduced environment, regardless of LXC?

Not in certain container types such as a full VM.

Re: Docker 0.7 runs on all Linux distributions

#130

Post by gcr »

k__ wrote: post #116
gcr wrote: post #113

Earlier quoted context omitted.

There's a sleight of hand going on here. The boundary between "kernel" and "libraries like libc" is very stable and doesn't change often. That means that often, the kernel distributed by Arch can work reasonably well in an Ubuntu system, and vice versa. With that in mind: The "ubuntu" image ships the "ubuntu-glibc" and "ubuntu-bash" and "ubuntu-coreutils" and so on, but they continue to work on your Arch host because…

ah, so only the host-kernel is used and I have to add (distribution specific) libraries to the container?

Pretty much.

Containers come with their libraries though; you don't have to "add" anything. You'd just apt-get it within the container and it would pull down its dependencies.

Post reply on HN