Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft, RedHat, IBM, Docker, Mesosphere, CoreOS and SaltStack join Kubernetes

googlecloudplatform.blogspot.com

Post reply on HN
Print view View original

51–56 of 56 posts

Re: Microsoft, RedHat, IBM, Docker, Mesosphere, CoreOS and SaltStack join Kubernetes

#51

Post by binarycrusader »

pstuart wrote: post #47
binarycrusader wrote: post #45

Earlier quoted context omitted.

All good, except you didn't bother posting anything of meaningful value. In what way, precisely, can Solaris objectively be qualified as what you describe?

Meaning that while Solaris had many technical advantages over Linux, it's not exactly a vibrant and growing community. Do you really think that any greenfield endeavor is going to pick Solaris as its OS? Disclaimer: I just left a gig where I spent 6 years in a Solaris shop, and while there wrote an on-demand zones management system.

So in other words, your comment really wasn't about Solaris, it was about ecosystem and community.

As for "vibrant" or "growing", I don't know how you would objectively measure those things or to what objective metric you would relatively compare them to.

Even if the Solaris community is not what you desire, the technology is still certainly significantly advancing almost every year.

Re: Microsoft, RedHat, IBM, Docker, Mesosphere, CoreOS and SaltStack join Kubernetes

#52

Post by binarycrusader »

xorcist wrote: post #46
binarycrusader wrote: post #44

Earlier quoted context omitted.

Regardless, I disagree with the assertion. linux-vservers barely had their first 1.0 release about a year (2004) before the release of Solaris Zones as a beta. It's likely that the actual development of Solaris zones started around the same time as linux-vservers. Even if you were to successfully argue that it "predates" Solaris zones -- it doesn't predate them by very much. The fact that Linux requires the kernel to…

> It's likely that the actual development of Solaris zones started around the same time as linux-vservers. That's what contemporary means . > linux-vserver wasn't valuable to go and stay in the mainline kernel. Lots of technology start out-of-tree and is only much later incorporated into mainline. That's part of what the big Linux distributors do for a living, and a healthy side of the Linux ecosystem. > none of the…

In the end, we're just going to have to agree to disagree.

Re: Microsoft, RedHat, IBM, Docker, Mesosphere, CoreOS and SaltStack join Kubernetes

#53

Post by evol262 »

binarycrusader wrote: post #49
evol262 wrote: post #48

Earlier quoted context omitted.

You're missing the point -- It's not unreasonable to compare the functionality of zones in 2014 with the functionality of vserver in 2014. But you compared the functionality of zones in 2014 with the functionality of vserver in 2005 (which hasn't changed much). LXC is the preferred container solution and has been for years. I only referenced vserver because of your "Linux finally catching up to zones" comment, when L…

I am not repeatedly missing what Docker does; all I'm pointing out is that Docker is currently insufficient as a true isolation solution from a security and/or other perspectives. Again, I'm sure Docker is appropriate for some specific situations, but it is not currently an appropriate general container solution if you care about security.

>I am not repeatedly missing what Docker does

>I'm sure Docker is appropriate for some specific situations, but it is not currently an appropriate general container solution if you care about security.

Yes, you are. Docker is not currently and is not trying to be a "general container solution". Again, that's LXC.

But "X is currently insufficient as 'true isolation'" is inane. libcontainer is built on top of kernel cgroups. Docker can be wholly isolated with selinux:

http://www.mankier.com/8/docker_selinux

You don't know what Docker does, you don't know what it's built on, you don't know how cgroups work, and you're entirely ignoring selinux.

Please stop.

Re: Microsoft, RedHat, IBM, Docker, Mesosphere, CoreOS and SaltStack join Kubernetes

#54

Post by [deleted] »

evol262 wrote: post #53
binarycrusader wrote: post #49

Earlier quoted context omitted.

I am not repeatedly missing what Docker does; all I'm pointing out is that Docker is currently insufficient as a true isolation solution from a security and/or other perspectives. Again, I'm sure Docker is appropriate for some specific situations, but it is not currently an appropriate general container solution if you care about security.

>I am not repeatedly missing what Docker does >I'm sure Docker is appropriate for some specific situations, but it is not currently an appropriate general container solution if you care about security. Yes, you are. Docker is not currently and is not trying to be a "general container solution". Again, that's LXC. But "X is currently insufficient as 'true isolation'" is inane. libcontainer is built on top of kernel cg…

[deleted]

Re: Microsoft, RedHat, IBM, Docker, Mesosphere, CoreOS and SaltStack join Kubernetes

#55

Post by binarycrusader »

evol262 wrote: post #53
binarycrusader wrote: post #49

Earlier quoted context omitted.

I am not repeatedly missing what Docker does; all I'm pointing out is that Docker is currently insufficient as a true isolation solution from a security and/or other perspectives. Again, I'm sure Docker is appropriate for some specific situations, but it is not currently an appropriate general container solution if you care about security.

>I am not repeatedly missing what Docker does >I'm sure Docker is appropriate for some specific situations, but it is not currently an appropriate general container solution if you care about security. Yes, you are. Docker is not currently and is not trying to be a "general container solution". Again, that's LXC. But "X is currently insufficient as 'true isolation'" is inane. libcontainer is built on top of kernel cg…

I'm done here. I agree to disagree. I still believe you are wrong and I did not claim Docker was a general container solution. You don't know how Solaris Zones work, because if you did, you'd understand that cgroups are insufficient to provide the same level of security.

Re: Microsoft, RedHat, IBM, Docker, Mesosphere, CoreOS and SaltStack join Kubernetes

#56

Post by evol262 »

binarycrusader wrote: post #55
evol262 wrote: post #53

Earlier quoted context omitted.

>I am not repeatedly missing what Docker does >I'm sure Docker is appropriate for some specific situations, but it is not currently an appropriate general container solution if you care about security. Yes, you are. Docker is not currently and is not trying to be a "general container solution". Again, that's LXC. But "X is currently insufficient as 'true isolation'" is inane. libcontainer is built on top of kernel cg…

I'm done here. I agree to disagree. I still believe you are wrong and I did not claim Docker was a general container solution. You don't know how Solaris Zones work, because if you did, you'd understand that cgroups are insufficient to provide the same level of security.

> I still believe you are wrong and I did not claim Docker was a general container solution

>I'm sure Docker is appropriate for some specific situations, but it is not currently an appropriate general container solution if you care about security.

>Docker doesn't provide the full security isolation that Solaris Zones does; I'm sure it's the right style of solution for specific cases, but it is not an appropriate general solution for isolation or containerisation.

Tell yourself whatever you need to.

>You don't know how Solaris Zones work, because if you did, you'd understand that cgroups are insufficient to provide the same level of security.

Which is why I also mentioned (and even linked you to the documentation for) docker_selinux, which is actually security instead of mere process isolation through namespaces and resource control (which are what cgroups do). Incidentally, this is the same way non-labeled zones work, but I guess I don't know anything about those.

Think whatever you want.

Post reply on HN