4 ms·

> it's a lot more important to serious uses of Docker than `docker cp` This is a cheap shot and has no basis in the reality of how open source projects are man

• eropple 11y ago
  I don't see much daylight between Docker the open-source project and Docker the venture-backed company trying to convince my clients to buy into their platform and not the other venture-backed companies' platforms. The Docker company and its employees have talked a lot of game and their security story is consistently subpar, be it recommended Dockerfiles running stuff as root users or the lack of stuff like user namespaces or running as a giant daemon where even read-only operations must run as root. The literally-literally most important security concern in containerland, not allowing container escapes to have host root, is not done by Docker. But `docker cp` is, built at least in part by people working for Docker-the-company (I went and looked to be sure). So you can call it a cheap shot, and that's fine, but this is something promised a long time ago and my concern is for the people who buy the hype because they don't know any better, not the people generating it and should.
  • shykes 11y ago
    Just to clarify: user namespaces will be a great additional layer in security, but they are still a relatively new feature, with very little actual use in production. You can already use them in runC [1] (Docker's low-level container runtime which we have broken out as a standalone tool). And once we have sorted out the hairy side-effects on UID mapping and network namespaces, we will integrate it into the Docker engine itself. But even then, we won't recommend running untrusted code as root inside a Linux container until the community has more time to battle-test user namespaces. [1] https://github.com/opencontainers/runc https://github.com/opencontainers/runc
    • mbreese 11y ago
      I think that you're missing the point (or at least talking around it). Namely - what is your timeline for actually securing Docker? Features like `docker cp` are nice, but don't help me when I really can't use Docker securely in production until things like user namespaces are running. I have multi-tenant systems and right now the only way for me to run Docker securely is to use it w/in a VM. Certainly, it will take time to battle-test anything, so the sooner that feature has been released, the sooner that we can get started doing the battle-testing. It would be helpful to have a clearer roadmap for features like this.
    • cpuguy83 11y ago
      And is also not the silver-bullet people hope it to be, being that there is absolutely no FS level support for userns.
  • digitalzombie 11y ago
    Yeeep, well said. I've been putting docker off cause of coreos rockt vs docker and the security problem. Was looking for alternative such as MirageOS and unikernel. Since it seems like Docker and CoreOS have settle their issue now I'm waiting on security.
    • tracker1 11y ago
      I've been really interested in Joyent's Triton implementation of the docker protocol and lx containers under SmartOS ... It actually seems like a much cleaner and more secure abstraction ironically enough (running linux under solaris, effectively). The network latency vs VM + Docker seems to be a lot better as well working better than other options like kubernetes/fabric etc. I think my only complaint about Joyent is their storage and services seem to be quite a bit more expensive than with Azure or AWS.