171–180 of 180 posts
Earlier quoted context omitted.
> built in the old-style scripting paradigm using a scripting language like Ruby, PHP, or (god help us) node.js I feel like I didn't get the memo... is the new-style we're all supposed to use microservices?
Microservices have won so hard that the fortune 500 are making it standard.
Earlier quoted context omitted.
because in borg land, everything apart from the binary is controlled by the scheduler. why is that good? because it means that the thing that knows about resource utilisation has control of what resources it give out. quite patch on the farm? give the low priority jobs more memory/cpu. You also have to remember that borg is part of the secret sauce that makes google tick. Having a single interface to a smart, efficie…
You might find this interesting: https://www.cl.cam.ac.uk/~rnw24/papers/2016-osdi-firmament.p...
Earlier quoted context omitted.
I've never had trouble installing Docker anywhere, whether from package managers or installers. Where have you, and what kind of trouble? If I might run into something similar down the road, better I should know about it now.
It used to be that docker could be installed literally by downloading the docker binary, then it was a single curl command. Now the documentation looks like this: https://www.docker.com/get-docker You press "get docker community image". Then you find your distro. Go to "download from the docker store", discover that there is no dowload link https://store.docker.com/editions/community/docker-ce-server... then you clic…
This article failed to mention the most important thing: An actual advantage of fat binaries. The closest he comes is saying that he feels the docker way is "old"... As compared with fat binaries, which is how desktop applications have been shipped for decades. Hell, size, the only clear would-be advantage, is only mentioned in a throaway sentence. > Yes, the network can be very powerful, but trying to use it for eve…
Kubernetes is scheduling and orchestration. It does compete with Docker, the company - it's a direct competitor of Swarm.
Docker, the container technology, is the de facto standard container at this time. That may not always be the case. Kubernetes is not Docker-specific, thus his mentioning of the open container initiative.
They are absolutely competitors.
Earlier quoted context omitted.
I've never had trouble installing Docker anywhere, whether from package managers or installers. Where have you, and what kind of trouble? If I might run into something similar down the road, better I should know about it now.
It used to be that docker could be installed literally by downloading the docker binary, then it was a single curl command. Now the documentation looks like this: https://www.docker.com/get-docker You press "get docker community image". Then you find your distro. Go to "download from the docker store", discover that there is no dowload link https://store.docker.com/editions/community/docker-ce-server... then you clic…
curl -o /tmp/get-docker.sh https://get.docker.com && bash /tmp/get-docker.sh
curl https://get.docker.com | bash
Earlier quoted context omitted.
Resume Driven Development can be just as bad for everyone involved.
That's a slanted take. Skills and experience that are only useful inside of one specific company are more likely to be less meaningful and effective (almost by definition). Many highly competent individuals like to understand the fundamentals and first principles of how systems work and how different problems can be solved, and thus find work that provides no transferable knowledge/experience to be less appealing. Of…
Earlier quoted context omitted.
Many highly competent individuals like to understand the fundamentals and first principles of how systems work and how different problems can be solved, and thus find work that provides no transferable knowledge/experience to be less appealing. Right, but to those people, whether you use Docker or Kubernetes or custom scripting or a unicorn whose horn magically creates new instances when you need them is mostly just…
This is definitely true for many people. However, I do think it's likely there are some fundamental principles at play that make tool 1 better than tool 2 in specific contexts, and I think it is valuable and interesting to explore that. Perhaps we are getting into the scientist vs. engineer mindset. I would guess, though, that the best engineers undoubtedly have some scientific curiousity helping them excel in their…
One extreme is that I see companies hold on to toxic employees because they're brilliant, even if they are bad for the company long term.
Earlier quoted context omitted.
> Thats not possible in Docker Believe this at your own peril.
At least right now, I do not know of a way to break out of a Docker container and the last bug I know of was fixed in 2014 ( https://blog.docker.com/2014/06/docker-container-breakout-pr... ). The only ways I know of that can be used to jailbreak are, as documented on https://security.stackexchange.com/a/153016 : kernel vulns (which are not inherent to Docker, and can hit you on any kind of Linux environment as soon a…
Docker for the longest time didn't even try to constrict the root user. Later versions does, but the results will vary depending on your configuration. That's why the Docker documentation states it should not be depended on for security. It is wise to heed that recommendation.
Earlier quoted context omitted.
I think that the main point was that docker skills are transferable, i.e. you can expect a new hire to be productive in less time. Too many companies still have in-house build/deploy systems that are probably great for their purpose but don't offer valuable experience that would be usable outside that company.
In my observation, Docker skills is a modern day ability to type "make", without being able to actually write a Makefile or debug a Makefile.
Earlier quoted context omitted.
zero days and the privilege escalation are a luxury. bad code is often plaged with injection/sql injection. Which sandbox does an absolute NOTHING to protect you from. After all, it is all within the expected side effects of your code.
What does this have to do with Docker then?
my point is that false sense of security makes it even easier for an attacker to use readily available privileges in the badly coded application.