Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How common is banning Docker?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 15 posts

Ask HN: How common is banning Docker?

#1

Post by martypitt »

I was doing some client work recently at a bank, where most of their engineering is offshored one of the big offshore companies.

The offshore team had to access everything via virtual desktops, and one of the restrictions was no virtualisation within the virtual desktop - so tooling like Docker was banned.

I was really surprsied to see modern JVM development going on, without access to things like TestContainers, LocalStack, or Docker at all.

To compound matters, they had a single shared dev env, (for cost reasons), so the team were constantly breaking each others stuff.

How common is this? Also, curious what kinds of workarounds people are using?

Re: Ask HN: How common is banning Docker?

#2

Post by galaxy_gas »

If they run in one dev env, (for cost reasons), it is preferably in Docker is VERY expensive if you are not using it for personal, noncommercial usage now ...

VDI VM in VM often not ideal aswell,

Docker is paid per seat monthly subscription for commercial usages

Re: Ask HN: How common is banning Docker?

#3

Post by anovikov »

It is not common and as you could have figured from the rest of this arrangement, it's just yes, this organisation is broken. Which is usually a good thing, broken places are usually to make money off that's why they remain broken for a long time - some places might go under because of that, but not a bank.

Re: Ask HN: How common is banning Docker?

#4

Post by martypitt »

galaxy_gas wrote: post #2

If they run in one dev env, (for cost reasons), it is preferably in Docker is VERY expensive if you are not using it for personal, noncommercial usage now ... VDI VM in VM often not ideal aswell, Docker is paid per seat monthly subscription for commercial usages

The block was not for docker license cost reasons - it was part compliance, and part an issue with the underlying VDI VM they were using.

The onshore team were able to use Docker, but not offshore.

Re: Ask HN: How common is banning Docker?

#5

Post by Bender »

I was doing some client work recently at a bank

Having worked for a bank I will add my jaded opinion. Throw logic out of the window. Banks have their own regulations, history and internal policies. Finding a job is hard right now so one may have to grin and just accept it. Don't think too much about it.

Ask them if you can use VMWare or VirtualBox in the virtual desktop and get a VMWare license assigned to you. It's clunky but something they might actually have and may save some headaches. If this is an option ask them which Linux ISO is permitted and where it is.

How common is this?

Very common for a bank especially for offshore or remote employees.

Also, curious what kinds of workarounds people are using?

Nobody outside of the bank will like this answer. Ask them what work around is permitted within the policy. If your questions are always without emotion and always centered around policy they may grow to like you and with time you may earn more trust than others making your job just a little easier.

Re: Ask HN: How common is banning Docker?

#6

Post by martypitt »

Bender wrote: post #5

I was doing some client work recently at a bank Having worked for a bank I will add my jaded opinion. Throw logic out of the window. Banks have their own regulations, history and internal policies. Finding a job is hard right now so one may have to grin and just accept it. Don't think too much about it. Ask them if you can use VMWare or VirtualBox in the virtual desktop and get a VMWare license assigned to you. It's…

Thanks!

I've finished up there now, so this is purely retrospective.

For them - the workaround (sadly) was -- a lack of testing.

I was really surprised that in a heavily regulated environment (this project faced off to a regulator) Integration testing (which has gotten really easy on the JVM thanks to stuff like TestContainers) just didn't exist.

That could be symptom of a broader lack of a test-driven culture though.

Re: Ask HN: How common is banning Docker?

#7

Post by apothegm »

It might just be an unintentional side effect of an older rule. They don’t want people running full-on nested VMs probably due to security concerns (inability to properly lock down the nested VMs). They wrote that rule in, say, 2005, and haven’t revisited it since the emergence of containerization as a best practice. Possibly because like most banks their software practices lag by decades.

Re: Ask HN: How common is banning Docker?

#9

Post by antonymoose »

scaredreally wrote: post #8

Every environment is a copy of the data, I would imagine. I think you would want to limit spawning of copies of your data in an offshore outsourced environment for security reasons. That's my guess.

Having worked in HFT, we had contractual obligations imposed on us by our customers for this very reason. In our case it wasn’t the data but rather the source code that we sold on to a few large banks that they were concerned for.
Post reply on HN