3 ms·
That's not a "security story" I've heard before. Surely containers make this much _easier_ than traditional VMs, because containers are designed (or should be d
by lobster_johnson 11y ago
That's not a "security story" I've heard before. Surely containers make this much _easier_ than traditional VMs, because containers are designed (or should be designed) to completely expendable. To do an "OS upgrade", just rebuild and redeploy.
If you're using a system that has rolling, verified, graceful restarts built in (e.g., Marathon, and I believe Kubernetes does, too), you'll easily avoid any downtime, which is harder to accomplish with classical VMs.
With a classical system (VM or otherwise) you'll still have to restart your apps whenever some library (glibc, ImageMagick or whatever) is patched. Docker doesn't change that. It does potentially minimize the surface area.
- snuxoll 11y agoMajor problem is there is a substantial lack of tooling to handle this. Meanwhile, managing updates for all of my servers is pretty painless with the plethora of system management tools out there - puppet keeps all my packages updated from my local yum repositories and restarts services as needed (aside from critical ones like postgresql that require manual intervention).
- Gigablah 11y agoOne possible way to go about this is to use your configuration management tool to update your images. Ansible 2.0 offers a Docker connector which you can use to run a playbook on a container the same way you'd run it on a host. The playbook tasks would look like: * Start a new container from the image you want to update * Using the Docker connector, run your various roles * Commit the container to a new image Then you'd push to your registry and redeploy your containers from the updated image. I suppose there should be something similar for Puppet...