Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The sad state of sysadmin in the age of containers

vitavonni.de

Post reply on HN
Print view View original

91–100 of 466 posts

Re: The sad state of sysadmin in the age of containers

#91

Post by rlpb »

mercurial wrote: post #81

I love a good rant as much as the next guy, but unfortunately, rants are rarely actionable. > Maven, ivy and sbt are the go-to tools for having your system download unsigned binary data from the internet and run it on your computer. The root of the problem is that out of the total number of libraries available in language X, only a small subset is packaged in Debian/RHEL. This may be more egregious with large, Java e…

> You cannot reasonably expect developers to package and maintain all their dependencies properly.

I think that this is a good point, but it all comes down to quality control.

You wouldn't accept a new dependency into your project if it is buggy or has a bad API.

So why is bad packaging, a hacked-up build system or inability to build from an auditable source considered acceptable in many communities today?

Re: The sad state of sysadmin in the age of containers

#92

Post by tormeh »

yAnonymous wrote: post #68
stephenr wrote: post #32

Earlier quoted context omitted.

I agree that the "just curl this into bash" instructions are nightmare - on any platform. I think a lot of this is a result of what I like to call the "Kumbaya approach to project/team management": This is where you have a team (either for a single project or a team at a consulting agency, etc) that is effectively all development-focused staff, possibly with some who dabble in Infrastructure/Ops. In this environment,…

>[1] yes this is an exaggeration No, it's not :(

It's just automated copy-pasting of commands you don't understand from the internet, which is something everyone who runs Linux (and is not a wizard) does all the time.

It's really really bad, but people will continue doing it until commands/things become so easy we can actually understand what we're doing. Unfortunately, this has never been a priority in Unix-land as far as I've gathered.

Re: The sad state of sysadmin in the age of containers

#93

Post by TeMPOraL »

TheDong wrote: post #45
lmm wrote: post #11

make is the least-auditable build tool imaginable. You don't have to obfuscate a Makefile, they come pre-obfuscated; you could put the "own me" commands right there in "plain" Make. Not to mention that it's often easier to tell whether a Java .class file is doing anything nefarious than whether a .c file is. How many sysadmins read the entire source of everything they install anyway? Maven, on the contrary, is the bi…

Signed packages isn't about just being signed. I could sign anything I like, but that doesn't make it any more secure for you to curl it into /bin/bash. Signatures are about who signs it, and that's not something mvn has solved at all. Mvn is a free-for-all of binary code that very well could own my system, wheras debian is a curated collection of software which the debian maintainers have signed as being compiled by…

> wheras debian is a curated collection of software which the debian maintainers have signed as being compiled by their systems with no malign influence and having met at least some bar.

This comes with a huge tradeoff, and I guess it's that tradeoff that makes developers like myself opt to sometimes even pipe the cURL to bash. I almost never download any software I actually plan to use through official system repositories, because whatever comes out of apt-get, it's almost always two years behind the last release and missing half the features I need. Sure, I'll apt-get install that libfoo-dev dependency, because I don't care what version it is as long as it's from the last decade. But for any application I actually need to use, it's either git repo or official binary download.

Re: The sad state of sysadmin in the age of containers

#94

Post by collyw »

pmontra wrote: post #54
skratlo wrote: post #37

Earlier quoted context omitted.

Same for "framework" which is: I have no idea what I'm doing

Sometimes yes, but sometimes you started writing CGIs in C, then Perl, than you wrote your microframework, then you decided to use a standard one. This has been my evolution and even if I don't understand everything inside the frameworks I'm using now I have a general idea. And furthermore, what can we do about it? Writing code from scratch or maintaining or own frameworks is more or less the way to losing customers,…

That sounds like where I am coming from. Looking at Django questions on Stack Overflow, a lot of people don't.

Re: The sad state of sysadmin in the age of containers

#95

Post by TeMPOraL »

tormeh wrote: post #92
yAnonymous wrote: post #68

Earlier quoted context omitted.

>[1] yes this is an exaggeration No, it's not :(

It's just automated copy-pasting of commands you don't understand from the internet, which is something everyone who runs Linux (and is not a wizard) does all the time. It's really really bad, but people will continue doing it until commands/things become so easy we can actually understand what we're doing. Unfortunately, this has never been a priority in Unix-land as far as I've gathered.

https://xkcd.com/1168/ comes to mind. And yes, I Google half of the command invocations too (but usually type them in by hand so that I can remember them faster instead of copy-pasting).

Re: The sad state of sysadmin in the age of containers

#96

Post by [deleted] »

empressplay wrote: post #21
rockdoe wrote: post #19

Earlier quoted context omitted.

it's also still standard practice in most companies to either read the source code of open-source stuff before deploying it to production Eh, no.

I'd love a specific example? Because in many countries if they're publicly-traded or subject to other regulations (such as Basel, etc.) any company that didn't would be breaking the law.

[deleted]

Re: The sad state of sysadmin in the age of containers

#97

Post by rickette »

DomreiRoam wrote: post #10

"Maven, ivy and sbt are the go-to tools for having your system download unsigned binary data from the internet and run it on your computer." You should setup a maven repository (Nexus, Artifactory) for your organisation if you want to have more control on binaries. Seems that artifactory can host docker files: https://www.jfrog.com/confluence/display/RTF/Docker+Reposito...

Right, do folks really belief Maven, Ivy, Gradle, Sbt are tools you use in production? These are developer tools for use on workstations and CI servers. If you want to promote your stuff to other environments like production use your own private repository (Nexus, etc).

Re: The sad state of sysadmin in the age of containers

#98

Post by cgb_ »

vacri wrote: post #86
cgb_ wrote: post #80

This rant is about containers, prebuilt VMs, and the incredible mess they cause because their concept lacks notions of "trust" and "upgrades". Prebuild VMs? Sure, I wouldn't touch them except for evaluating a project, and for commercial software you may not have a choice. But docker containers at least usually provide a dockerfile that describes exactly how a binary image is built. You just clone the source repo, aud…

then you are doing containers wrong... The old-school sysadmins I know scoff at Docker's idea of 'containers'. Linux containers were already a thing, and don't need an entire copy of an OS ported around with them. To them, containers are a way of enveloping a process to limit it, not a way of distributing packaged software. They may or may not be doing 'docker' right, but they certainly know what 'linux containers' a…

Well I should have qualified it with 'docker containers'. But yeah, those that have been around long enough in Linux container land have all dealt with vserver, openvz, lxc, etc, and all of those carried around this 'entire copy' of an OS, per container (ignoring vserver's vhashify). Docker helps you to spin up N containers running all sorts of applications based on the single master image.

Docker, whether your view is good or bad, brings something more than just another container implementation to the table...

Re: The sad state of sysadmin in the age of containers

#99

Post by duggan »

The contract between operations and dev (as concepts, not as people) is in need of renewal.

To my mind, that was what "devops" was supposed to be, but it's been a bit of a dogpile in the years since the term gained popularity.

Systems are opaque to most developers, and many developers wish to make their software opaque to the system on which it runs. This is a failure on behalf of our entire profession, not any one group.

Infrastructure software is in a bit of a renaissance period, but it's very early days. Packaging software is a total mystery to most developers. I don't even need to back that up with examples, most of us can recall the last time we can across a well packaged piece of software with joy due to sheer rarity. I'd be very surprised to find the average age of a Debian maintainer was trending anything but upwards, and steeply.

Containers are being misused, but that's because the alternatives we've been building for ourselves have not kept up with the strong user experience narrative of web and mobile software.

We need to do better.

Post reply on HN