Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissatisfied with Docker

robert.ocallahan.org

Post reply on HN
Print view View original

221–229 of 229 posts

Re: Dissatisfied with Docker

#221

Post by nwmcsween »

pbar wrote: post #125
nwmcsween wrote: post #116

Earlier quoted context omitted.

Seccomp is a horrible security model for containers, if the application or it's libraries use differing syscalls the seccomp ruleset is invalid

A process making a system call to the kernel functions the same way regardless of whether it is in a container or not. How exactly does the security model differ at all?

Because 99.9% of software doesn't make use of direct syscalls, instead it uses wrappers or standard functions that wrap various other syscalls that can and will change over time. Meaning $app_container v0.1 can and probably will have a different seccomp filter than $app_container v0.2

Re: Dissatisfied with Docker

#222

Post by nikisweeting »

ptman wrote: post #185
nikisweeting wrote: post #121

Earlier quoted context omitted.

No docker-compose suppport.

https://github.com/containers/podman-compose

I know, but have you actually tried using it though? It's not going to be a viable production-grade docker-compose replacement for quite a while unless they get some serious funding or open-source attention.

Re: Dissatisfied with Docker

#223

Post by nikisweeting »

likeclockwork wrote: post #122
nikisweeting wrote: post #120

Earlier quoted context omitted.

Yeah but no docker-compose support :/ dealbreaker for us. Theres an alpha podman-compose project but we couldn't get it running.

You really don't need it since podman has pods of containers that communicate with each other. You can export and playback the pods as kubernetes yaml.. but I just use a bash script + an environment file to configure, create and launch pods. What else is docker-compose really doing for you?

Our entire company runs on like ~20 docker-compose files. It's a super elegant way to describe collections of containers without the management overhead of Kubernetes. We've had nothing but good experiences with compose, and lots of headaches with Docker swarm and K8s.

Re: Dissatisfied with Docker

#224

Post by nikisweeting »

dharmab wrote: post #192
nikisweeting wrote: post #120

Earlier quoted context omitted.

Yeah but no docker-compose support :/ dealbreaker for us. Theres an alpha podman-compose project but we couldn't get it running.

Both Podman and CRI-O support Pods, which can fill the same use case as docker-compose

Which require kubernetes, which requires a full-time team member just to manage. Docker-compose has been a lifesaver for low-complexity declarative service management on our self-hosted systems.

Re: Dissatisfied with Docker

#225

Post by nikisweeting »

paulddraper wrote: post #203
fhgsfkcc wrote: post #202

Earlier quoted context omitted.

secrets don't belong in env vars, because many languages and/or frameworks will happily dump all your env vars to users in the event of misconfiguration or some errors.

I have literally never seen that happen. (Outside a core dump, which has a lot more than env var.) You have any examples in mind?

Django error pages with DEBUG=True.

Re: Dissatisfied with Docker

#226

Post by TheWizardofOdds »

VonGallifrey wrote: post #199
chatmasta wrote: post #197

Earlier quoted context omitted.

How do you come to this conclusion from this pricing page? [0] I might be missing something but that seems like serverless pricing. You might be thinking of the pricing scheme when Fargate first launched? Or maybe you’re thinking of ECS, which does in fact charge as you described. [0] https://aws.amazon.com/fargate/pricing/

Everything I am reading there screams container service and not serverless. Some Quotes: > You pay for the amount of vCPU and memory resources consumed by your containerized applications. How does vCPU fit into serverless architecture? > Pricing is based on requested vCPU and memory resources for the Task. Tasks being a collection of Containers. This is simply a container service like ECS or EKS. > Pricing is calcula…

From https://www.learnaws.org/2019/09/14/deep-dive-aws-fargate/

> Fargate and Lambda are both serverless technologies from AWS.

Re: Dissatisfied with Docker

#227

Post by [deleted] »

FreeHugs wrote: post #220
rlpb wrote: post #219

Earlier quoted context omitted.

That's no different from Docker's community images, is it? And as I pointed out, Ubuntu ships official images, which was demonstrated in my second command.

Don't know about Ubuntu because I use Debian. docker.io calls their Debian images "official" and says they are maintained by two Debian developers.

[deleted]

Re: Dissatisfied with Docker

#228

Post by pbar »

nwmcsween wrote: post #221
pbar wrote: post #125

Earlier quoted context omitted.

A process making a system call to the kernel functions the same way regardless of whether it is in a container or not. How exactly does the security model differ at all?

Because 99.9% of software doesn't make use of direct syscalls, instead it uses wrappers or standard functions that wrap various other syscalls that can and will change over time. Meaning $app_container v0.1 can and probably will have a different seccomp filter than $app_container v0.2

This is the same case regardless of being in a container or not, $app v0.1 and $app v0.2 will have different filters

Re: Dissatisfied with Docker

#229

Post by nwmcsween »

pbar wrote: post #228
nwmcsween wrote: post #221

Earlier quoted context omitted.

Because 99.9% of software doesn't make use of direct syscalls, instead it uses wrappers or standard functions that wrap various other syscalls that can and will change over time. Meaning $app_container v0.1 can and probably will have a different seccomp filter than $app_container v0.2

This is the same case regardless of being in a container or not, $app v0.1 and $app v0.2 will have different filters

Of course will but docker, et al attach filters to containers vs attaching it to a specific binary that is much easier (although still broken).
Post reply on HN