6 ms·

It’s astonishing to me that people would argue that docker is some how a simpler solution. Some would happily maintain a container registry, constantly worry ab

It’s astonishing to me that people would argue that docker is some how a simpler solution. Some would happily maintain a container registry, constantly worry about the order of operations in your docker file, create a build pipeline in a format incompatible with non docker use cases, spend time understanding how dockers bridge interacts with multiple Network controllers over learning how your operating system works.

deleted 8y ago
[deleted]
viraptor 8y ago
There's docker and there's docker. Docker as a local container builder/runner is simple. Docker as a deployment / networking / scheduling service is not. Not everyone is using Docker for more than "run this script in an environment I want".
gsich 8y ago
>It’s astonishing to me that people would argue that docker is some how a simpler solution. Some say docker is the new "curl|bash" ;)
- TheDong 8y ago
  Really now? Here's a docker container with a shell you can type anything in to: https://contained.af/ https://contained.af/ If you manage to tell me what's in /etc/os-release on the machine (not inside the container), I'll eat my lunch.
  - jrs95 8y ago
    So...if we don’t, will you ever eat lunch again?
  - progval 8y ago
    The issue with curl|bash is not just the security (you can run curl|bash as an unprivileged user). It's also the fact that it generally doesn't do anything to integrate well with your system, and just pull all its dependencies in a folder and never update it afterward.
spacenick88 8y ago
To me one of the most valuable parts of docker is almost never mentioned. The fact that a Dockerfile exactly describes the steps necessary to get from a fresh OS image to a working instance of whatever you're containerizing is one of the main selling points. To me that's what other technologies like rkt seem to miss or at least choose not to focus on.
- TheDong 8y ago
  They describe how to do it in an impure non-reproducible way. They're not much different from nix expressions, or brew formulas or such. Unlike nix expressions (or rpm specfiles or various other technologies), the dockerfile format never concerned itself with clearly defining the hashes of inputs and dependencies, reproducibility, working without network access on build farms, etc etc, Sure, it ended up being popular and usable, but at the cost of taking the art of describing how software is installed back in time.
  - vesak 8y ago
    It's interesting how the people who "do things correctly" and the people who "do things usably" almost never are the same people. Could it be that these things are mutually exclusive? Anecdotally, I've tried to learn Nix for several years. I learned to write Dockerfiles in hours.
    - wahern 8y ago
      It's not a coincidence that most Docker containers are built using Debian- or Red Hat-derived images. It's because they have proper packaging systems which are consistently applied, which is what allows them to build and maintain 10s of thousands of projects in a reusable format. The intersection of "correct" and "usable" substantially overlap; certainly much more so than "incorrect" and "usable". Don't confuse expedience with usability.
    - Sean1708 8y ago
      > Anecdotally, I've tried to learn Nix for several years. Out of interest, what did you find difficult? I ask because I spent last weekend setting up NixOS, and the only things I found difficult were discoverability and documentation (I spent a lot of time just reading through the source code). Edit: Thinking about it it's very possible that this is just a case of me not knowing what I don't know, since I'm not currently trying to do anything particularly complex.
pabloski 8y ago
I'm astonished too. The section on use cases doesn't help to justify why we need all this complexity. Maybe they are trying to compensate for the inefficiency of the Unix permission system ( having user, group and world is lacking in a lot of situations by today standards ). The other solution is to implement a totally different mechanism ( ACL + some other thing, Capabilities ) but then you lose retrocompatibility.
- wahern 8y ago
  > having user, group and world is lacking in a lot of situations by today standards A process has supplemental group membership. If you were only limited to the above, then, yes, you would need to share resources through world or utilize a special broker if you wanted multiple privilege domains for a service. But with supplemental groups you can be as fine-grained as you want. Just create a group for each domain with a unique membership set and make that a supplemental group for each user with access to that domain. When you want to share a file, just chown and chmod appropriately. To see how this works in practice, look at BSDAuth (OpenBSD's alternative to PAM). Rather than using dynamically loadable modules for authentication methods--which effectively means that any program that wants to use authentication services needs root permissions--BSDAuth uses setuid and setgid helpers in /usr/libexec/auth. $ ls -lhd /usr/libexec/auth/ drwxr-x--- 2 root auth 512B Mar 24 13:23 /usr/libexec/auth/ $ doas ls -lh /usr/libexec/auth/ total 372 -r-xr-sr-x 4 root _token 21.3K Mar 24 13:23 login_activ -r-sr-xr-x 1 root auth 9.0K Mar 24 13:23 login_chpass -r-xr-sr-x 4 root _token 21.3K Mar 24 13:23 login_crypto -r-sr-xr-x 1 root auth 17.2K Mar 24 13:23 login_lchpass -r-sr-xr-x 1 root auth 9.0K Mar 24 13:23 login_passwd -r-xr-sr-x 1 root _radius 17.1K Mar 24 13:23 login_radius -r-xr-xr-x 1 root auth 9.0K Mar 24 13:23 login_reject -r-xr-sr-x 1 root auth 9.0K Mar 24 13:23 login_skey -r-xr-sr-x 4 root _token 21.3K Mar 24 13:23 login_snk -r-xr-sr-x 4 root _token 21.3K Mar 24 13:23 login_token -r-xr-sr-x 1 root auth 21.0K Mar 24 13:23 login_yubikey In this scheme, for any user who you want to grant permission to test basic system authentication you add the auth group to their supplemental group. Et voila, they can now use the framework, but without root permissions. For mechanisms that you may want to grant separately you use a separate group (e.g. _radius). Like many bad ideas, Docker basically won because you can use it to isolate and package pre-existing, broken software. And because it's easier to find examples of how to [abuse] Docker for sharing files across security domains than on how to use supplemental groups to do this.
StreamBright 8y ago
It’s astonishing to me that how little functionality can be achieved in 10M+ / 550K lines of code. https://www.openhub.net/p/docker https://www.openhub.net/p/docker (10M+) https://www.openhub.net/p/systemd https://www.openhub.net/p/systemd (550K+)

deleted 8y ago

[deleted]

viraptor 8y ago

There's docker and there's docker. Docker as a local container builder/runner is simple. Docker as a deployment / networking / scheduling service is not. Not everyone is using Docker for more than "run this script in an environment I want".

gsich 8y ago

>It’s astonishing to me that people would argue that docker is some how a simpler solution. Some say docker is the new "curl|bash" ;)

TheDong 8y ago
Really now? Here's a docker container with a shell you can type anything in to: https://contained.af/ https://contained.af/ If you manage to tell me what's in /etc/os-release on the machine (not inside the container), I'll eat my lunch.
- jrs95 8y ago
  So...if we don’t, will you ever eat lunch again?
- progval 8y ago
  The issue with curl|bash is not just the security (you can run curl|bash as an unprivileged user). It's also the fact that it generally doesn't do anything to integrate well with your system, and just pull all its dependencies in a folder and never update it afterward.

spacenick88 8y ago

To me one of the most valuable parts of docker is almost never mentioned. The fact that a Dockerfile exactly describes the steps necessary to get from a fresh OS image to a working instance of whatever you're containerizing is one of the main selling points. To me that's what other technologies like rkt seem to miss or at least choose not to focus on.

TheDong 8y ago
They describe how to do it in an impure non-reproducible way. They're not much different from nix expressions, or brew formulas or such. Unlike nix expressions (or rpm specfiles or various other technologies), the dockerfile format never concerned itself with clearly defining the hashes of inputs and dependencies, reproducibility, working without network access on build farms, etc etc, Sure, it ended up being popular and usable, but at the cost of taking the art of describing how software is installed back in time.
- vesak 8y ago
  It's interesting how the people who "do things correctly" and the people who "do things usably" almost never are the same people. Could it be that these things are mutually exclusive? Anecdotally, I've tried to learn Nix for several years. I learned to write Dockerfiles in hours.
  - wahern 8y ago
    It's not a coincidence that most Docker containers are built using Debian- or Red Hat-derived images. It's because they have proper packaging systems which are consistently applied, which is what allows them to build and maintain 10s of thousands of projects in a reusable format. The intersection of "correct" and "usable" substantially overlap; certainly much more so than "incorrect" and "usable". Don't confuse expedience with usability.
  - Sean1708 8y ago
    > Anecdotally, I've tried to learn Nix for several years. Out of interest, what did you find difficult? I ask because I spent last weekend setting up NixOS, and the only things I found difficult were discoverability and documentation (I spent a lot of time just reading through the source code). Edit: Thinking about it it's very possible that this is just a case of me not knowing what I don't know, since I'm not currently trying to do anything particularly complex.

pabloski 8y ago

I'm astonished too. The section on use cases doesn't help to justify why we need all this complexity. Maybe they are trying to compensate for the inefficiency of the Unix permission system ( having user, group and world is lacking in a lot of situations by today standards ). The other solution is to implement a totally different mechanism ( ACL + some other thing, Capabilities ) but then you lose retrocompatibility.

wahern 8y ago
> having user, group and world is lacking in a lot of situations by today standards A process has supplemental group membership. If you were only limited to the above, then, yes, you would need to share resources through world or utilize a special broker if you wanted multiple privilege domains for a service. But with supplemental groups you can be as fine-grained as you want. Just create a group for each domain with a unique membership set and make that a supplemental group for each user with access to that domain. When you want to share a file, just chown and chmod appropriately. To see how this works in practice, look at BSDAuth (OpenBSD's alternative to PAM). Rather than using dynamically loadable modules for authentication methods--which effectively means that any program that wants to use authentication services needs root permissions--BSDAuth uses setuid and setgid helpers in /usr/libexec/auth. $ ls -lhd /usr/libexec/auth/ drwxr-x--- 2 root auth 512B Mar 24 13:23 /usr/libexec/auth/ $ doas ls -lh /usr/libexec/auth/ total 372 -r-xr-sr-x 4 root _token 21.3K Mar 24 13:23 login_activ -r-sr-xr-x 1 root auth 9.0K Mar 24 13:23 login_chpass -r-xr-sr-x 4 root _token 21.3K Mar 24 13:23 login_crypto -r-sr-xr-x 1 root auth 17.2K Mar 24 13:23 login_lchpass -r-sr-xr-x 1 root auth 9.0K Mar 24 13:23 login_passwd -r-xr-sr-x 1 root _radius 17.1K Mar 24 13:23 login_radius -r-xr-xr-x 1 root auth 9.0K Mar 24 13:23 login_reject -r-xr-sr-x 1 root auth 9.0K Mar 24 13:23 login_skey -r-xr-sr-x 4 root _token 21.3K Mar 24 13:23 login_snk -r-xr-sr-x 4 root _token 21.3K Mar 24 13:23 login_token -r-xr-sr-x 1 root auth 21.0K Mar 24 13:23 login_yubikey In this scheme, for any user who you want to grant permission to test basic system authentication you add the auth group to their supplemental group. Et voila, they can now use the framework, but without root permissions. For mechanisms that you may want to grant separately you use a separate group (e.g. _radius). Like many bad ideas, Docker basically won because you can use it to isolate and package pre-existing, broken software. And because it's easier to find examples of how to [abuse] Docker for sharing files across security domains than on how to use supplemental groups to do this.

StreamBright 8y ago

It’s astonishing to me that how little functionality can be achieved in 10M+ / 550K lines of code. https://www.openhub.net/p/docker https://www.openhub.net/p/docker (10M+) https://www.openhub.net/p/systemd https://www.openhub.net/p/systemd (550K+)