Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The sad state of sysadmin in the age of containers

vitavonni.de

Post reply on HN
Print view View original

361–370 of 466 posts

Re: The sad state of sysadmin in the age of containers

#361

Post by squar1sm »

stephenr wrote: post #332
squar1sm wrote: post #314

Earlier quoted context omitted.

Funny tumblr but makes me care-confused. I understand that curl pipe sh could have security problems but I also don't see it as that much different than the "normal" and "ok" way of doing things. I would consider something like the below pretty normal. wget https://whatever.io/latest.tgz tar xzf latest.tgz cd whatever-stable ./configure && make sudo make install Because of familiarity, we aren't going to be too worri…

I wouldn't consider what you presented as the "normal" or "ok" way of doing things either, especially not on anything resembling a live (i.e. not development/sandbox) environment. A distro (or official vendor, or possibly a trusted third-party) repo of pre-built, signed packages would always be my first choice. If one of those isn't available, my next step would be to create a package for the tool in question, part o…

About "ok". You're right. I probably used a loaded word without context. I too use whatever default package repo, followed by "extras" or whatever is available. You described a sane and nice process. I guess my point is, at some point we are are assuming "many eyes" (the binaries might be built with the previously mentioned make;configure steps) unless you are auditing all sources which is unlikely. Especially unlikely on dev machines. Even after that it seems like there is an infinite continuum of paranoia.

I find it interesting that binary packages have existed for decades and yet `rpm etc` knowledge is rare. Why did curl sh become popular? Why doesn't every project have rpm|deb download links for every distro version? Why don't github projects have binary auto-builds hosted by github? I'd argue that it's too difficult. Binary packaging didn't succeed universally. For deployment, containers are (in the end) easier.

But the original article is conflating container concepts and user behavior (not wrongly). If docker hub does end up hosting malware-laden images, it would be interesting emergent behavior but it would be orthogonal to containers. Like toolbars. Toolbars probably aren't evil. A vector for evil maybe?

Re: The sad state of sysadmin in the age of containers

#362

Post by Alupis »

kbar13 wrote: post #355
mjibson wrote: post #335

Earlier quoted context omitted.

I spent an entire day last week attempting to build hadoop with LZO compression support. There are many outdated guides on the internet about how to do this, and I eventually gave up and spent a few hours getting the cloudera packages to install in a Dockerfile so I could reproduce my work later. Figuring out which software packages I needed, how to modify my environment variables, which compiler to get, and where to…

> no new features Go gets us better performance and concurrency out of the box.

> Go gets us better performance

Than Java? At best, GO performs on par with Java, but is often measured 10-20% slower.[1][2][3]

This is usually attributed to the far more mature optimizing compiler in the JVM, which ultimately compiles bytecode down to native machine code, especially for hot paths. Java performance for long running applications is on par with C (one of the reasons it's a primary choice for very high performing applications such as HFT, Stock Exchanges, Banking, etc).

> concurrency out of the box.

Java absolutely supports concurrency "out of the box"...[4]

[1] http://zhen.org/blog/go-vs-java-decoding-billions-of-integer...

[2] http://stackoverflow.com/questions/20875341/why-golang-is-sl...

[3] http://www.reddit.com/r/golang/comments/2r1ybd/speed_of_go_c...

[4] http://docs.oracle.com/javase/7/docs/api/java/util/concurren...

Re: The sad state of sysadmin in the age of containers

#363

Post by ommunist »

skywhopper wrote: post #232

I agree that many of these convenient setups are embarrassingly sloppy, but it's the sysadmin's responsibility to insist on production deployments being far more rigorous. No one can tell you how to build hadoop? Well, figure it out. Random Docker containers being downloaded? Use a local Docker repo with vetted containers and Dockerfiles only. I don't even allow vendor installers to run on my production systems. My e…

@skywhopper "it's a failure of the company or organization or of his own communication skills" <~ Oh man, ever had a rant from The Management like "we pay you to do what we say"? No one usually cares about communication skills of sysadmin. Yes, its a failure of organisation. Sad truth is - most organisations are failed. Sysadmin today is a marginal job at a small company, where people respect you, or a job in the medium or large company where he or she are just peons.

Re: The sad state of sysadmin in the age of containers

#365

Post by pjmlp »

Alupis wrote: post #356
pjmlp wrote: post #347

Earlier quoted context omitted.

> They also produce binaries which don't necessarily require a runtime to be available on every server Just like Java[0]. It is just a matter of choosing the right compiler for the use case at hand. [0] - http://www.excelsiorjet.com/ (one from many vendors)

There's also things like exec4j which bundles everything including a JVM into an executable which one can just run... and things like AdvancedInstaller and Install4j will also allow one to bundle a JVM. So producing a binary which doesn't require a separate runtime really isn't a problem.

Since you mention it, Java 8 brings bundling and installers support into the reference JDK.

Re: The sad state of sysadmin in the age of containers

#367

Post by rudolf0 »

dikaiosune wrote: post #342
thaumaturgy wrote: post #341

Earlier quoted context omitted.

> No startups are hiring sysadmins to do any kind of work anymore. Then maybe people should be willing to work for more grown-up businesses. HN tends to get a distorted view of what's important in the tech industry. The tech industry is way, way, way bigger than startups, and there are still plenty of companies that recognize the value of good sysadmins. Let the startups learn their lesson in their own time.

The alternative is that many of the startups don't learn this in their own time, and they go on to become bigger, more successful companies who can set the tone and shift the market. Of course, if they're actually able to succeed by doing so, then that says something too. Although the trend of many data breaches certainly wouldn't decline in that case.

>Although the trend of many data breaches certainly wouldn't decline in that case.

Exactly. Successful and profitable are not mutually exclusive with "secure" or "well-architected". At least until those last two come to bite you later and start eating into your profits.

Re: The sad state of sysadmin in the age of containers

#368

Post by getsat »

pjmlp wrote: post #347
getsat wrote: post #331

Earlier quoted context omitted.

Go and modern C++ are both quite a bit more terse than Java. They also produce binaries which don't necessarily require a runtime to be available on every server (just ABI compatibility). (I have no horse in this race, I am just writing what I think the grandparent comment was referring to)

> They also produce binaries which don't necessarily require a runtime to be available on every server Just like Java[0]. It is just a matter of choosing the right compiler for the use case at hand. [0] - http://www.excelsiorjet.com/ (one from many vendors)

Cool concept, I didn't realise this existed. Can you run Hadoop and friends under this? I've worked at companies with over 500 servers in a Hadoop cluster and literally never once heard about anything other than using Oracle's JRE aside from one proposal to use OpenJDK which was shot down pretty quickly.

Re: The sad state of sysadmin in the age of containers

#369

Post by TeMPOraL »

gnaritas wrote: post #270
lmm wrote: post #253

Earlier quoted context omitted.

> Those case differences have meaning, -r is generally not dangerous while -R is; it's capitalized to make you stop and say hmmm, should I do this. All commands have the same flag language Except with cp , -R is the safe one and -r is the dangerous one. And there are tons of little inconsistencies like this.

As I said, generally. All human languages have inconsistencies, the command line is by far one of the most consistent ones any of us deal with.

It may be more consistent, but is not easier - humans are generous with regard to input, they can infer intentions from context. I could type in "please unbork this" to a human and he'd know precisely that he has to a) untargzip it, b) change the directory structure and c) upload it to a shared directory for our team.

Re: The sad state of sysadmin in the age of containers

#370

Post by skywhopper »

jetpks wrote: post #324
skywhopper wrote: post #232

I agree that many of these convenient setups are embarrassingly sloppy, but it's the sysadmin's responsibility to insist on production deployments being far more rigorous. No one can tell you how to build hadoop? Well, figure it out. Random Docker containers being downloaded? Use a local Docker repo with vetted containers and Dockerfiles only. I don't even allow vendor installers to run on my production systems. My e…

> it's the sysadmin's responsibility to insist on production deployments What decade are you from? No startups are hiring sysadmins to do any kind of work anymore. They're hiring "dev-ops" people, which seems to mean "Amateur $popularLanguage developer that deployed on AWS this one time." That's the whole problem with the dev-ops ecosystem. None of these dev-ops people seem to have any ops experience.

Well, like I said, in this case, "it's a failure of the company".
Post reply on HN