Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The sad state of sysadmin in the age of containers (2015)

vitavonni.de

Post reply on HN
Print view View original

11–20 of 324 posts

Re: The sad state of sysadmin in the age of containers (2015)

#11

Post by black_puppydog »

pram wrote: post #6

Terrible article IMO. Hadoop is an awful mess, but it has nothing to do with Docker, which is simplistic in comparison. "Ever tried to security update a container?" Yes, I have! In fact you can maintain patch compliance in a container pretty much the same way you'd maintain a VM or bare metal Linux installation!

> Hadoop is an awful mess, but it has nothing to do with Docker, which is simplistic in comparison.

The fact that they can get away with a build system like this is very much due to docker (and curl | sudo bash) allow people to not feel the pain this mess causes, at least not right away.

> Yes, I have! In fact you can maintain patch compliance in a container pretty much the same way you'd maintain a VM or bare metal Linux installation!

But then you lose the declarative/immutable nature of docker, no? Except if you mean every time there's a security update, you rebuild your containers?

Re: The sad state of sysadmin in the age of containers (2015)

#12

Post by contravariant »

arberavdullahu wrote: post #9
_def wrote: post #2

I don't know that much about the state of container systems these days, but to me it seems it's the "comfortable" way in the "security vs comfort" tradeoff. Use where applicable and hope for better days.

I don't think you should put security at any case in tradeoff, by your argument one can save passwords in plaintext because its easy and comfortable, but its just not acceptable and this would effect not only your app but every app that your users use.

If you don't make a tradeoff you end up with passwords to long to remember and security to cumbersome to not circumvent.

Security has a cost, as does the lack of it, hence the trade-off.

Re: The sad state of sysadmin in the age of containers (2015)

#13

Post by Yuval_Halevi »

I saw this comment now from 4 years ago on reddit:

Software packaging and building seems to be becoming more complicated and more disconnected-- particularly as more specific tools continue to be developed. It seems every little corner has their own dependency management and build management solution.

The Docker comments seem a little backhanded. If one looks at a Dockerfile, there's not much to complain about. It downloads a key, it adds a repository, installs a package, and some very simple docker-specific tweaks.

If you distrust Docker's signed image, building your own is as simple as doing a git clone ..; cd docker-nginx; docker build. Docker encourages disposable containers, separating data, and making your own images. There's still a lot of work for Docker to do regarding signed images, but I'd argue running isolated images with documented changesets and simple build files is far different from blindly running 'curl | sudo bash'

https://old.reddit.com/r/programming/comments/33ktc9/the_sad...

Re: The sad state of sysadmin in the age of containers (2015)

#14

Post by jve »

This all boils down to trust.

`curl | sudo bash` is no different than .\install.exe. The question is about trusting the SOURCE and trusting the DISTRIBUTION channel (that HTTP download from scala-lang.org violates this).

Where did you get it? from https://microsoft.com/... or from https://micro.soft.com/...? Whom you trust more? The same with pre-built VM image or whatever... do you trust the party that made this image/container available?

Re: The sad state of sysadmin in the age of containers (2015)

#15

Post by onion2k »

Ever tried to security update a container?

The whole point of using a container is that you can destroy it and build a new one easily. The new one should be built using up-to-date packages with security patches applied (and tested, obvs). Using the 'pets versus cattle'[1] analogy, patching a container feels like you're treating it like a pet. You should just kill it and get a new one instead.

[1] https://thenewstack.io/how-to-treat-your-kubernetes-clusters...

Re: The sad state of sysadmin in the age of containers (2015)

#16

Post by x3n0ph3n3 »

arberavdullahu wrote: post #9
_def wrote: post #2

I don't know that much about the state of container systems these days, but to me it seems it's the "comfortable" way in the "security vs comfort" tradeoff. Use where applicable and hope for better days.

I don't think you should put security at any case in tradeoff, by your argument one can save passwords in plaintext because its easy and comfortable, but its just not acceptable and this would effect not only your app but every app that your users use.

The trade-off is always between security and accessibility. If you want a completely secure computer, bury it at the bottom of a mineshift and pour a few yards of concrete over it. No one is breaking into that anytime soon!

Re: The sad state of sysadmin in the age of containers (2015)

#17

Post by onion2k »

black_puppydog wrote: post #11
pram wrote: post #6

Terrible article IMO. Hadoop is an awful mess, but it has nothing to do with Docker, which is simplistic in comparison. "Ever tried to security update a container?" Yes, I have! In fact you can maintain patch compliance in a container pretty much the same way you'd maintain a VM or bare metal Linux installation!

> Hadoop is an awful mess, but it has nothing to do with Docker, which is simplistic in comparison. The fact that they can get away with a build system like this is very much due to docker (and curl | sudo bash) allow people to not feel the pain this mess causes, at least not right away. > Yes, I have! In fact you can maintain patch compliance in a container pretty much the same way you'd maintain a VM or bare metal…

Except if you mean every time there's a security update, you rebuild your containers?

That's exactly what you should be doing, at least if you're relatively small scale. Google probably takes a different approach but most of us aren't working at that scale.

Re: The sad state of sysadmin in the age of containers (2015)

#18

Post by pram »

black_puppydog wrote: post #11
pram wrote: post #6

Terrible article IMO. Hadoop is an awful mess, but it has nothing to do with Docker, which is simplistic in comparison. "Ever tried to security update a container?" Yes, I have! In fact you can maintain patch compliance in a container pretty much the same way you'd maintain a VM or bare metal Linux installation!

> Hadoop is an awful mess, but it has nothing to do with Docker, which is simplistic in comparison. The fact that they can get away with a build system like this is very much due to docker (and curl | sudo bash) allow people to not feel the pain this mess causes, at least not right away. > Yes, I have! In fact you can maintain patch compliance in a container pretty much the same way you'd maintain a VM or bare metal…

First: No one installs Hadoop from scratch, and Hadoop isn't built with Docker. Companies use Ambari or other distros like EMR.

Second: Yes, generally you can use a build system like Jenkins, and a registry like Artifactory to automate the process. The docker image is updated, and then you can push it out with your orchestration in whatever method you choose. It's not an obscure or difficult thing to manage..

Re: The sad state of sysadmin in the age of containers (2015)

#19

Post by jwr »

I recently had a similar discussion with people using npm for building a CSS framework library. I tried to explain the concept of getting a pre-downloaded tarball and using "make" (or similar) to produce target artifacts from source files in a deterministic, repeatable and reliable manner, without relying on any third-party servers being available and without pulling in dependencies that might have changed.

It seems the concept was entirely alien to programmers younger than me.

Re: The sad state of sysadmin in the age of containers (2015)

#20

Post by Gravityloss »

jwr wrote: post #19

I recently had a similar discussion with people using npm for building a CSS framework library. I tried to explain the concept of getting a pre-downloaded tarball and using "make" (or similar) to produce target artifacts from source files in a deterministic, repeatable and reliable manner, without relying on any third-party servers being available and without pulling in dependencies that might have changed. It seems…

It can be sold as a new invention in a few years.
Post reply on HN