51–60 of 248 posts
Earlier quoted context omitted.
Why would you be allowing devs to directly deploy to production in a company with 30,000 developers? Surely you'd have proper release management where Ops teams would review deployment artifacts before deploying them?
You wouldn’t but you wouldn’t give every dev root access to every dev box either... would you?
For a very long time there was a gaping security hole in Docker: anyone who could run a container could mount anything on the underlying host as root. This says to me that Docker (the company) don’t really consider any use cases beyond “fooling around on a personal laptop”. Meanwhile other container projects took seriously from day 1 that they would need to run in production. Docker (the company) certainly helped to…
A couple of things :- You can still mount filesystems as root from a container, if you have Docker command rights. In Docker's security model access to run docker commands on a given host == root, that's a design choice AFAIK, not an oversight. It's perfectly possible to mitigate that issue, by restricting who can run containers and also ensuring that all containers specify and use a non-root user account (or enable…
Otherwise you can hard code a UID when creating the user in the Dockerfile but that means your containers aren't generally portable.
In the end, the path of least resistance is to run as root within the container and simply accept the security implications if using volumes.
Earlier quoted context omitted.
You don't need a whole cluster to get started, you can use Minikube locally for example : https://minikube.sigs.k8s.io/docs/
If uptime is not a concern and only one node is intended, docker-compose is a far more efficient solution to any k8s solution.
The problem i have with cubernetes is the following: I as a small developer and small server owner don't have the ressources to even get started. The first thing i see at cubernetes is a cluster. Why a cluster. Do i need to cluster my Raspberry pi's to get something out of it? Do i need to buy 3 servers just to run 5 containers? In docker its easy. Download Docker. Start container. Install container manager like plat…
Why bother with containers at all at that scale then? We keep on using plain old VMs, while watching everyone rush into containers fashion.
VirtualBox feels like installing a regular computer. It takes a long time and is a lot of manual work. If you want to change something you login on the existing VM until you reach a point where you no longer remember all the changes you've made over the years. The machine is unclean.
I realize that there are solutions out there for automating VM deployments but Docker did a good job of catering, and perhaps marketing, to developers.
The problem i have with cubernetes is the following: I as a small developer and small server owner don't have the ressources to even get started. The first thing i see at cubernetes is a cluster. Why a cluster. Do i need to cluster my Raspberry pi's to get something out of it? Do i need to buy 3 servers just to run 5 containers? In docker its easy. Download Docker. Start container. Install container manager like plat…
Why bother with containers at all at that scale then? We keep on using plain old VMs, while watching everyone rush into containers fashion.
It's not like containers are new technology, even on Linux; we were using OpenVZ a decade ago. Now they're just integrated into the mainline.
I also feel sorry for Docker, in a way. Was it their arrogance, or just incompetence? The came up with this amazing tool, that lot of companies started using, but they did not have a business strategy on how to make money in a long term. They tried to keep up (Docker Swarm, Docker Hub Premium, Tutum, Moby, Docker Community vs Docker Enterprise etc). But at the end they just seem like they don't really know how to app…
Earlier quoted context omitted.
A couple of things :- You can still mount filesystems as root from a container, if you have Docker command rights. In Docker's security model access to run docker commands on a given host == root, that's a design choice AFAIK, not an oversight. It's perfectly possible to mitigate that issue, by restricting who can run containers and also ensuring that all containers specify and use a non-root user account (or enable…
If you run in your container as a non-root user, it makes working with volumes a pain. Who knows what the container user UID will map to on the host and whether this host user, if any, will have permissions to access files in the volume. Otherwise you can hard code a UID when creating the user in the Dockerfile but that means your containers aren't generally portable. In the end, the path of least resistance is to ru…
That's what I am doing for local development setups with Docker.
See https://github.com/a2way-com/template-docker-laravel/blob/ma... and its README.
I also feel sorry for Docker, in a way. Was it their arrogance, or just incompetence? The came up with this amazing tool, that lot of companies started using, but they did not have a business strategy on how to make money in a long term. They tried to keep up (Docker Swarm, Docker Hub Premium, Tutum, Moby, Docker Community vs Docker Enterprise etc). But at the end they just seem like they don't really know how to app…
What did Moby try to do anyway?