38 ms·

As a distribution user who is a developer for other things, I can totally relate, here. Nowadays, I use docker for basically every development I make, so that I

As a distribution user who is a developer for other things, I can totally relate, here. Nowadays, I use docker for basically every development I make, so that I don't have to rely on whatever state my host system is. This is not just to bypass distributions problems, it has advantages on its own, like easily using different version of interpreter/compiler without even thinking about it, and easily ejecting the whole environment when I don't need it anymore. My server is structured just like that too : a few sysadmin tools installed on host, then plenty of docker images/containers. It's just more convenient. As an end user browsing web, watching movies and playing on steam, though, things are quite different. I've been a gentoo user for a decade, but I finally migrated to ubuntu (kde neon recently, but it's still ubuntu based) because it was becoming the standard. You can expect most vendors to have at least ubuntu in mind, and it's a big win as an user. And it's not as painful as it was as a developer (my main reason to use gentoo was use flags and fine tuned configuration), because docker covers all my needs there.

vidarh 9y ago
I'm increasingly using Docker (and to a lesser extent systemd-nspawn and rkt) to containerise things even on my laptop). For very small tools it doesn't make sense, but the time it takes to start a container is low enough that I have an increasing array of things where the only thing installed locally is a wrapper that does "docker run ...". But in terms of distro, I agree - Ubuntu is painless enough that even though I e.g. use i3wm and otherwise install a bunch of stuff that is non-standard, Ubuntu is sufficiently convenient as a starting point.
- majewsky 9y ago
  Does `docker pull` do any form of signing? Because if it does, I've never seen it. I'm just waiting for some adversary to insert some malware in a popular library image (something like nginx:latest or ruby:2.3) and have that deployed on thousands, if not millions of servers. Assuming, of course, that this has not already happened (cough National Security Letter cough). System package managers have protections in place against that: Package signing means that you now have to hack the packager's laptop and obtain their signing key to publish malicious packages, and reproducible builds will close that attack vector as well. (Which is why I'm very disappointed that distributions are not pushing reproducible builds as a top priority. If nothing else, this might make me switch to NixOS soon.)
  - gtirloni 9y ago
    https://docs.docker.com/engine/security/trust/content_trust/ https://docs.docker.com/engine/security/trust/content_trust/
  - vidarh 9y ago
    It can, but it's more cumbersome than it should be. It's one of the things rkt does much better (signed by default; need to explicitly disable trust if you want to pull something that isn't properly signed. But also, I think you overstate the benefit you get from system package managers there in that people quickly get groomed into accepting it as normal to add extra APT repositories and the like to install some app, or bypass the system packages entirely (curl somesite | bash, anyone?) or use a series of third party package managers (npm, rubygems etc.), all of which massively increases the attack surface. So if you only trust your distro, packager, sure. But most people end up pulling things from far more sources. While Docker security is by no means painless, this is one more reason to run things in containers. You're right to worry about the base images, but I'd still argue you're at least in marginally better shape if you run that "curl somesite | bash" inside a container (I'll assume that it won't stop a dedicated attacker, but it has far more potential to stop accidents or lower level attackers). I'm trying to move more of my stuff to rkt, as I think it gets more things right and signatures by default is one of them. Being able to exchange the container runtime for whatever level of isolation works best for your app is another thing (ranging from just chroot to LKVM)
  - dom0 9y ago
    Docker docs: > Currently, content trust is disabled by default. So no, no signing ;)
  - mikegerwitz 9y ago
    > Which is why I'm very disappointed that distributions are not pushing reproducible builds as a top priority. If nothing else, this might make me switch to NixOS soon. Yes, it's unfortunately a step in the wrong direction, which is alarming considering the scale at which Docker is used. I haven't used Nix, but I use Guix, and GuixSD is its distribution. Like Nix, it's a functional package manager, so not only do you get package signing, but you also get a fully verifiable and reproducible (barring certain packages that aren't yet reproducible) state of the entire system. It's not that containers and Docker can't succeed in solving some of these problems. Guix can create docker images, for example. Better yet, it can run things in isolation in containers, even ad-hoc, without the need for Docker. https://www.gnu.org/software/guix/news/running-system-services-in-containers.html https://www.gnu.org/software/guix/news/running-system-servic... You can even run your browser in a container and share the X11 session: https://github.com/pjotrp/guix-notes/blob/master/CONTAINERS.org https://github.com/pjotrp/guix-notes/blob/master/CONTAINERS.... (And in that regard, we also have Qubes OS, but that doesn't have the benefit of a functional package manager, unless you use Guix/Nix of course.)
digi_owl 9y ago
Best i can tell, most of the middleware/plumbing devs do not have Ubuntu in mind, they have Fedora in mind. This because Fedora is basically the dev edition of RHEL, and RH is one of the biggest employers of plumbing devs in the Linux ecosystem.

vidarh 9y ago

I'm increasingly using Docker (and to a lesser extent systemd-nspawn and rkt) to containerise things even on my laptop). For very small tools it doesn't make sense, but the time it takes to start a container is low enough that I have an increasing array of things where the only thing installed locally is a wrapper that does "docker run ...". But in terms of distro, I agree - Ubuntu is painless enough that even though I e.g. use i3wm and otherwise install a bunch of stuff that is non-standard, Ubuntu is sufficiently convenient as a starting point.

majewsky 9y ago
Does `docker pull` do any form of signing? Because if it does, I've never seen it. I'm just waiting for some adversary to insert some malware in a popular library image (something like nginx:latest or ruby:2.3) and have that deployed on thousands, if not millions of servers. Assuming, of course, that this has not already happened (cough National Security Letter cough). System package managers have protections in place against that: Package signing means that you now have to hack the packager's laptop and obtain their signing key to publish malicious packages, and reproducible builds will close that attack vector as well. (Which is why I'm very disappointed that distributions are not pushing reproducible builds as a top priority. If nothing else, this might make me switch to NixOS soon.)
- gtirloni 9y ago
  https://docs.docker.com/engine/security/trust/content_trust/ https://docs.docker.com/engine/security/trust/content_trust/
- vidarh 9y ago
  It can, but it's more cumbersome than it should be. It's one of the things rkt does much better (signed by default; need to explicitly disable trust if you want to pull something that isn't properly signed. But also, I think you overstate the benefit you get from system package managers there in that people quickly get groomed into accepting it as normal to add extra APT repositories and the like to install some app, or bypass the system packages entirely (curl somesite | bash, anyone?) or use a series of third party package managers (npm, rubygems etc.), all of which massively increases the attack surface. So if you only trust your distro, packager, sure. But most people end up pulling things from far more sources. While Docker security is by no means painless, this is one more reason to run things in containers. You're right to worry about the base images, but I'd still argue you're at least in marginally better shape if you run that "curl somesite | bash" inside a container (I'll assume that it won't stop a dedicated attacker, but it has far more potential to stop accidents or lower level attackers). I'm trying to move more of my stuff to rkt, as I think it gets more things right and signatures by default is one of them. Being able to exchange the container runtime for whatever level of isolation works best for your app is another thing (ranging from just chroot to LKVM)
- dom0 9y ago
  Docker docs: > Currently, content trust is disabled by default. So no, no signing ;)
- mikegerwitz 9y ago
  > Which is why I'm very disappointed that distributions are not pushing reproducible builds as a top priority. If nothing else, this might make me switch to NixOS soon. Yes, it's unfortunately a step in the wrong direction, which is alarming considering the scale at which Docker is used. I haven't used Nix, but I use Guix, and GuixSD is its distribution. Like Nix, it's a functional package manager, so not only do you get package signing, but you also get a fully verifiable and reproducible (barring certain packages that aren't yet reproducible) state of the entire system. It's not that containers and Docker can't succeed in solving some of these problems. Guix can create docker images, for example. Better yet, it can run things in isolation in containers, even ad-hoc, without the need for Docker. https://www.gnu.org/software/guix/news/running-system-services-in-containers.html https://www.gnu.org/software/guix/news/running-system-servic... You can even run your browser in a container and share the X11 session: https://github.com/pjotrp/guix-notes/blob/master/CONTAINERS.org https://github.com/pjotrp/guix-notes/blob/master/CONTAINERS.... (And in that regard, we also have Qubes OS, but that doesn't have the benefit of a functional package manager, unless you use Guix/Nix of course.)

digi_owl 9y ago

Best i can tell, most of the middleware/plumbing devs do not have Ubuntu in mind, they have Fedora in mind. This because Fedora is basically the dev edition of RHEL, and RH is one of the biggest employers of plumbing devs in the Linux ecosystem.