4 ms·

I attended her talk on "Containerizing Your Desktop" at LinuxCon NA 2015, and she maintains this open source repository filled with awesome Dockerfiles that can

I attended her talk on "Containerizing Your Desktop" at LinuxCon NA 2015, and she maintains this open source repository filled with awesome Dockerfiles that can run anything from Spotify to Chrome. Truly amazing https://github.com/jessfraz/dockerfiles https://github.com/jessfraz/dockerfiles

ziotom78 10y ago
What is the point of running Chrome in a Docker container? Is it useful only for developers which want to test stuff using a fixed version of the browser, or is it something that everybody surfing the web should really want to do? (I am not a web developer, so this is a sincere question. I am genuinely curious!)
- hvidgaard 10y ago
  Have you ever wondered why a computer seems to slow down over time, but after a reinstall it is magically faster? That is because programs install a lot of things, and often don't uninstall everything again, even if you ask it to. Putting programs in a container means you keep your main system free of this cruft.
  - angry_octet 10y ago
    AKA https://en.wikipedia.org/wiki/DLL_Hell https://en.wikipedia.org/wiki/DLL_Hell and the non-solutions of WinSxS (https://en.wikipedia.org/wiki/Side-by-side_assembly https://en.wikipedia.org/wiki/Side-by-side_assembly) and the current 'binaries are linked to an exactly matching library forever, install EVERY possible library version'. https://web.archive.org/web/20100305054645/http://msdn.microsoft.com/en-us/library/ms811694.aspx https://web.archive.org/web/20100305054645/http://msdn.micro...
- vidarh 10y ago
  I don't think it's something everyone should want to do today, but there is a broader push to experiment with better isolation and portability of applications, and dockerizing applications is one avenue of experimenting with that (others would be things like NixOS or Qubes OS). Note that in terms of isolation, I would be hesitant to consider this (dockerizing apps) a particularly strong solution in terms of security now, but isolation is not only about security, but also about e.g. preventing applications from crapping files all over your system (and being able to know where they've put files - e.g. "docker diff" is quite nice), and having convenient ways of restricting their resource usage etc. For me at least, when I dockerize apps it tends to be about those concerns, as well as being able to run multiple versions of apps conveniently etc. or to be able to package up a whole toolchain and lock it at combinations of tools I know work well together.
- nl 10y ago
  There are lots of potential reasons. Some things I've considered doing it for (many of which have alternative solutions, but nevertheless) Different network configurations per browser. This is useful for doing things like checking geo-targetting via VPNs etc. Better security isolation. Chrome is pretty good at this, but if you want to run a suspicious add-on this is a good way to do it. Better isolation for scriptable browsers. I'm sure there are plenty I haven't thought of.
  - imglorp 10y ago
    Not the best isolation however because containers aren't sandboxes (yet). If you're really serious you need to run something like https://firejail.wordpress.com https://firejail.wordpress.com .
    - nl 10y ago
      I think (hope?) people would realize that by now about Docker. But it is a non-trivial amount of protection against things like local file access.
djhworld 10y ago
By your description I thought she'd just created 5 or so examples, I wasn't expecting such a breadth of stuff! Did she talk about advantages/disadvantages to this approach? Does she use this daily?
- adictator 10y ago
  Yes, she uses this daily. For example, chrome is a shortcut that just runs a docker container, she does video conferencing using skype, also running inside a container - video, audio & all. She's one of the few that uses a Linux only laptop while the majority in the company used Macbooks.
andrelaszlo 10y ago
I saw Jess' "Application Sandboxes vs. Containers" talk at Craft Conference last year. Very interesting! http://www.ustream.tv/recorded/86185167 http://www.ustream.tv/recorded/86185167
Esau 10y ago
I think doing that is kind of insane but I love that she is doing it. Also, as an OS geek, I enjoy reading about the setups of other geeks.

ziotom78 10y ago

What is the point of running Chrome in a Docker container? Is it useful only for developers which want to test stuff using a fixed version of the browser, or is it something that everybody surfing the web should really want to do? (I am not a web developer, so this is a sincere question. I am genuinely curious!)

hvidgaard 10y ago
Have you ever wondered why a computer seems to slow down over time, but after a reinstall it is magically faster? That is because programs install a lot of things, and often don't uninstall everything again, even if you ask it to. Putting programs in a container means you keep your main system free of this cruft.
- angry_octet 10y ago
  AKA https://en.wikipedia.org/wiki/DLL_Hell https://en.wikipedia.org/wiki/DLL_Hell and the non-solutions of WinSxS (https://en.wikipedia.org/wiki/Side-by-side_assembly https://en.wikipedia.org/wiki/Side-by-side_assembly) and the current 'binaries are linked to an exactly matching library forever, install EVERY possible library version'. https://web.archive.org/web/20100305054645/http://msdn.microsoft.com/en-us/library/ms811694.aspx https://web.archive.org/web/20100305054645/http://msdn.micro...
vidarh 10y ago
I don't think it's something everyone should want to do today, but there is a broader push to experiment with better isolation and portability of applications, and dockerizing applications is one avenue of experimenting with that (others would be things like NixOS or Qubes OS). Note that in terms of isolation, I would be hesitant to consider this (dockerizing apps) a particularly strong solution in terms of security now, but isolation is not only about security, but also about e.g. preventing applications from crapping files all over your system (and being able to know where they've put files - e.g. "docker diff" is quite nice), and having convenient ways of restricting their resource usage etc. For me at least, when I dockerize apps it tends to be about those concerns, as well as being able to run multiple versions of apps conveniently etc. or to be able to package up a whole toolchain and lock it at combinations of tools I know work well together.
nl 10y ago
There are lots of potential reasons. Some things I've considered doing it for (many of which have alternative solutions, but nevertheless) Different network configurations per browser. This is useful for doing things like checking geo-targetting via VPNs etc. Better security isolation. Chrome is pretty good at this, but if you want to run a suspicious add-on this is a good way to do it. Better isolation for scriptable browsers. I'm sure there are plenty I haven't thought of.
- imglorp 10y ago
  Not the best isolation however because containers aren't sandboxes (yet). If you're really serious you need to run something like https://firejail.wordpress.com https://firejail.wordpress.com .
  - nl 10y ago
    I think (hope?) people would realize that by now about Docker. But it is a non-trivial amount of protection against things like local file access.

djhworld 10y ago

By your description I thought she'd just created 5 or so examples, I wasn't expecting such a breadth of stuff! Did she talk about advantages/disadvantages to this approach? Does she use this daily?

adictator 10y ago
Yes, she uses this daily. For example, chrome is a shortcut that just runs a docker container, she does video conferencing using skype, also running inside a container - video, audio & all. She's one of the few that uses a Linux only laptop while the majority in the company used Macbooks.

andrelaszlo 10y ago

I saw Jess' "Application Sandboxes vs. Containers" talk at Craft Conference last year. Very interesting! http://www.ustream.tv/recorded/86185167 http://www.ustream.tv/recorded/86185167

Esau 10y ago

I think doing that is kind of insane but I love that she is doing it. Also, as an OS geek, I enjoy reading about the setups of other geeks.