3 ms·

It should be quite doable to spin up a container/VM on demand. I'd probably look at lxd/lxc or bsd jails for this (both with zfs for storage) - or if there now

by e12e 8y ago

It should be quite doable to spin up a container/VM on demand. I'd probably look at lxd/lxc or bsd jails for this (both with zfs for storage) - or if there now are any real ways to run containers under hw virtualization - maybe that. Maybe something like: https://github.com/rkt/rkt/blob/master/Documentation/running-kvm-stage1.md https://github.com/rkt/rkt/blob/master/Documentation/running... for VM backed containers - but I'm not sure if it's considered stable and/or secure.

tombh 8y ago
Thanks for the suggestion. I'm already using Kubernetes/Docker for the `ssh brow.sh` service. What advantages would your approach have?
- e12e 8y ago
  I don't think I'd look too hard at lxd or freebsd as you already have a docker setup. But hw isolation might be worth investigating - as others are saying - hostile access to a web browser, including webmail etc - is pretty dangerous. And plain docker never had a good story wrt secure isolation. Apparently there was "hypernetes", now stackube - for combining VM runtime and kubernetes: https://kubernetes.io/blog/2016/05/hypernetes-security-and-multi-tenancy-in-kubernetes/ https://kubernetes.io/blog/2016/05/hypernetes-security-and-m... https://github.com/openstack/stackube https://github.com/openstack/stackube As far as I can tell, this allows the mix of k8 style pod/container management and VM level isolation: https://stackube.readthedocs.io/en/latest/stackube_scope_clarification.html https://stackube.readthedocs.io/en/latest/stackube_scope_cla... As for lxd/freebsd jails and zfs - both offer very nice and easy to grasp environment for isolated services - and both should end a little more isolated than a typicaldocker setup (some services running as root in container, no additional lxc restrictions). But all things considered, if you already have k8/docker set up to give every user a separate, possibly ephemeral container... Infrastructure is probably not where I'd devote most time. It should work well enough as is.

by e12e 8y ago

tombh 8y ago

Thanks for the suggestion. I'm already using Kubernetes/Docker for the `ssh brow.sh` service. What advantages would your approach have?

e12e 8y ago
I don't think I'd look too hard at lxd or freebsd as you already have a docker setup. But hw isolation might be worth investigating - as others are saying - hostile access to a web browser, including webmail etc - is pretty dangerous. And plain docker never had a good story wrt secure isolation. Apparently there was "hypernetes", now stackube - for combining VM runtime and kubernetes: https://kubernetes.io/blog/2016/05/hypernetes-security-and-multi-tenancy-in-kubernetes/ https://kubernetes.io/blog/2016/05/hypernetes-security-and-m... https://github.com/openstack/stackube https://github.com/openstack/stackube As far as I can tell, this allows the mix of k8 style pod/container management and VM level isolation: https://stackube.readthedocs.io/en/latest/stackube_scope_clarification.html https://stackube.readthedocs.io/en/latest/stackube_scope_cla... As for lxd/freebsd jails and zfs - both offer very nice and easy to grasp environment for isolated services - and both should end a little more isolated than a typicaldocker setup (some services running as root in container, no additional lxc restrictions). But all things considered, if you already have k8/docker set up to give every user a separate, possibly ephemeral container... Infrastructure is probably not where I'd devote most time. It should work well enough as is.