Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The sad state of sysadmin in the age of containers

vitavonni.de

Post reply on HN
Print view View original

51–60 of 466 posts

Re: The sad state of sysadmin in the age of containers

#51

Post by bshimmin »

So much truth in this.

We've been doing some work with Elastic Beanstalk lately, and - while it certainly does one or two things that are extremely clever and useful - in the end it just feels like this bizarre mix of complete magic and incredibly convoluted arcana. Everything feels very out of our control and locks us into an ecosystem that considerably limits our choices and flexibility (unless we invest the time in becoming experts in EB, which really isn't particularly something we have the time for). And, as the author of this post says, the security ramifications, while orthogonal, are also deeply troubling.

Re: The sad state of sysadmin in the age of containers

#52

Post by [deleted] »

mauricemir wrote: post #44
hurin wrote: post #12

Earlier quoted context omitted.

> Many people have this weird aversion to doing basic sysadmin stuff with Linux. What makes it weird is that it's really simple. Often easier than figuring out another deploy system. While I agree with the articles main points - the GNU build system is far from simple. Basically an arcane syntax limited to unix-based systems and 5 or 6 100+ page manuals to cover. It doesn't excuse it - but I think it's easy to see wh…

I have never under stood why some many people are not ok with using the command line. A few years back we had an issue where a mysql script was over the limit for phpmyadmin - my fairly experienced colleague he was unaware that you could log into the cli and use mysql from the cli.

[deleted]

Re: The sad state of sysadmin in the age of containers

#53

Post by highmastdon »

skratlo wrote: post #37
zenlot wrote: post #2

"Stack is the new term for "I have no idea what I'm actually using"." - this made my day!

Same for "framework" which is: I have no idea what I'm doing

Same goes for 'abstraction', it hides the essence of what is happening. Therefore every abstraction is evil.

Re: The sad state of sysadmin in the age of containers

#54

Post by pmontra »

skratlo wrote: post #37
zenlot wrote: post #2

"Stack is the new term for "I have no idea what I'm actually using"." - this made my day!

Same for "framework" which is: I have no idea what I'm doing

Sometimes yes, but sometimes you started writing CGIs in C, then Perl, than you wrote your microframework, then you decided to use a standard one. This has been my evolution and even if I don't understand everything inside the frameworks I'm using now I have a general idea. And furthermore, what can we do about it? Writing code from scratch or maintaining or own frameworks is more or less the way to losing customers, unless you are a Facebook and you call engineer and push a React.

Re: The sad state of sysadmin in the age of containers

#55

Post by stephenr »

mauricemir wrote: post #14
blfr wrote: post #4

This bothers me as well. Even tasks as simple as adding a repository are now being "improved" with a curl | sudo bash style setup[1]. However, installing from source with make was (and remains) a mess. It may work if you're dedicated to maintaining one application and (part of) its stack. But even then it usually leads to out of date software and tracking versions by hand. Many people have this weird aversion to doin…

:-) I managed to get haddoop running on a small cluster from scratch Michael Nolls turtorial is a good starting point. Full stack should mean you can and have used a soldering iron in anger and also have at least a CCNA level of networking.

When you say anger, do you mean to threaten the developer who wants to run `chmod 777 /var/www` when their just-installed php app released in 2003 won't allow uploads?

Edit: Maybe I should have added a /sarcasm to my comment?

Re: The sad state of sysadmin in the age of containers

#56

Post by Nursie »

prottmann wrote: post #47
NhanH wrote: post #7

So, asking the obvious question: what's the solution to that?

The obvious question is: what's the real problem with that? A container is a container, as long as docker itself has not bug, the container can only harm the containers content. Most problems exists in the custom created software in the container (e.g. web-services with bugs, backdoors, ....), this will be a problem for Docker, VMs, Real-Servers, whatever too. The real problem is the interoperability of different con…

>> A container is a container, as long as docker itself has not bug, the container can only harm the containers content.

Presumably a container has network access of some sort? Malicious code could start probing and attacking anything exposed that way.

>> this will be a problem for Docker, VMs, Real-Servers, whatever too.

The implication is that you wouldn't get into this situation with a 'Real-Server' so easily, because you wouldn't just download an image and run it, without having an update/patch strategy or having much more idea of what's going on inside it.

Re: The sad state of sysadmin in the age of containers

#57

Post by empressplay »

peteretep wrote: post #15
[deleted] wrote: post #13

[deleted]

> As far as I know, it's also still standard practice in > most companies to either read the source code of open- > source stuff before deploying it to production (binary > or build) or get a support contract from someone else > who has I'm afraid I have no better, more cogent response for this than 'lol'.

This is an interesting read: http://www.bearingpoint.com/en-no/download/Open_Source_Gover...

Re: The sad state of sysadmin in the age of containers

#58

Post by [deleted] »

blfr wrote: post #4

This bothers me as well. Even tasks as simple as adding a repository are now being "improved" with a curl | sudo bash style setup[1]. However, installing from source with make was (and remains) a mess. It may work if you're dedicated to maintaining one application and (part of) its stack. But even then it usually leads to out of date software and tracking versions by hand. Many people have this weird aversion to doin…

[deleted]

Re: The sad state of sysadmin in the age of containers

#59

Post by tribaal »

prottmann wrote: post #47
NhanH wrote: post #7

So, asking the obvious question: what's the solution to that?

The obvious question is: what's the real problem with that? A container is a container, as long as docker itself has not bug, the container can only harm the containers content. Most problems exists in the custom created software in the container (e.g. web-services with bugs, backdoors, ....), this will be a problem for Docker, VMs, Real-Servers, whatever too. The real problem is the interoperability of different con…

You seem to ignore or downplay all the other ways a container can cause problems, including but not limited to:

- Being a backdoor to the rest of your network (sniffing network traffic, or more simply reverse ssh-tunneling to an outside server)

- All the various "fun" botnet-related activities (spam being the king here)

- Actively serving malware to the rest of your network.

EDIT: Formatting, and well, others answered your question less specifically but more eloquently.

Re: The sad state of sysadmin in the age of containers

#60

Post by rsanders »

I was doing sysadmin the "right way" a long, long time ago, and I don't see much difference. Maybe the author regularly does full audits of the source code of every package he downloads, and of course disassembles every executable and library in the underlying OS, but most of us don't. There's no wisdom or security to be gained from the act of running "make", much less "make install".
Post reply on HN