5 ms·

So the main points of this rant are: - BSD has ZFS (but so do some Linux distros) - Linux bad because BTRFS, so it's bad (well, you don't have to use it) - B

So the main points of this rant are: - BSD has ZFS (but so do some Linux distros) - Linux bad because BTRFS, so it's bad (well, you don't have to use it) - BSD jails > anything on linux (I was hoping to see a clear outline of pros/cons, but the author's reasoning is very hard to follow, and the tone is very combative instead of constructive)

hacknat 8y ago
At this point there really isn’t any security difference between zones, jails, and hardened containers. That word “hardened” is the key. Zones are a primitive in Illumos, containers are not a primitive in Linux, they are a collection of security features. If you use them all then you can achieve parity with Zones, but surprisingly few projects make use of all of them by default (Docker certainly doesn’t). The main difference then is usability, which is almost always the biggest security flaw in any piece of software (that the security isn’t “on” by default or has a prohibitive learning curve for the user).
- posix_me_less 8y ago
  > Docker certainly doesn’t Do you think LXD gets closer to Zones in terms of security?
  - hacknat 8y ago
    Honestly, I don’t know, but my guess is that it had some things turned off by default. Actually K8s is the most encouraging project in this regard in that it has opinions about how containers should work so they are slowly adding all the secure options by default when containers are orchestrated to the various runtimes. There are only a few features left that remain to be turned on (user namespacing being the most notable).
    - technofiend 8y ago
      I paraphrased you by cutting down your comment, hope that's OK. >Actually K8s [...] are slowly adding all the secure options by default [...] (user namespacing being the most notable). K8's RBAC is nice, and in particular auth-delegator really helps with odd duck integration for the enterprise. But k8s is reliant on OS features to make user namespaces happen and Redhat customers are still waiting for Redhat to backport a newer version of shadow-utils [1] [2] to RHEL 7 so that user namespacing works there. Given enterprise certification and release cycles "Wait for RHEL 8" isn't really a good answer for those kind of customers. I'm not disagreeing with you, just saying some features of kubernetes aren't available everywhere. Personally I'd really like to see user namespaces come to RHEL 7 as it helps with removing or mitigating privileged access. [1] https://bugzilla.redhat.com/show_bug.cgi?id=1498628 https://bugzilla.redhat.com/show_bug.cgi?id=1498628 [2] https://access.redhat.com/solutions/3657531 https://access.redhat.com/solutions/3657531
- qlk1123 8y ago
  Just a weakly related comment here. When one talks about security, it's really hard for people to follow what she really means; the context has always been qualitative, but not quantitative. I found the idea "Vertical/Horizontal Attack Profile" interesting, which may help measure security when people argues different container solutions or even VMs. https://blog.hansenpartnership.com/measuring-the-horizontal-attack-profile-of-nabla-containers/ https://blog.hansenpartnership.com/measuring-the-horizontal-...
pdx6 8y ago
SmartOS has native ZFS support and zones.
- rbanffy 8y ago
  Isn't SmartOS and Illumos essentially the same OS?
  - dijit 8y ago
    SmartOS is IllumOS derived. Much in the same way Linux has distributions; OpenSolaris has "spins". You don't install IllumOS, you install one of the distributions of it.
    - rbanffy 8y ago
      What are the differences between SmartOS and IllumOS WRT zones and ZFS?
      - dijit 8y ago
        The same difference for XFS between Linux and Ubuntu. IE; aside from minor differences in current version, nothing.
lmm 8y ago
> - Linux bad because BTRFS, so it's bad (well, you don't have to use it) The point is that there are no good filesystem options for Linux. ext4 has various issues mainly due to being ext2 underneath, reiserfs is unmaintained, xfs and jfs have no recovery tools at all (and xfs additionally has the trailing zeroes problem), and all of those require you to use a separate system for RAID for which Linux has no good options (true hardware RAID is expensive, BIOS RAID (dm-raid) and software RAID (md) will kick out disks during a rebuild if they see a single bad sector, which per https://www.zdnet.com/article/why-raid-6-stops-working-in-2019/ https://www.zdnet.com/article/why-raid-6-stops-working-in-20... is more likely than not with modern disk sizes. This risk is reduced (but not eliminated) by setting up regular scrubs, but tutorials and installation wizards don't always do that). BTRFS has issues up to and including data loss, userspace ZFS has major performance and reliability issues while in-kernel ZFS on Linux has substantial licensing concerns. > - BSD jails > anything on linux (I was hoping to see a clear outline of pros/cons, but the author's reasoning is very hard to follow, and the tone is very combative instead of constructive) Agreed that the writing is bad, but BSD jails do have a much higher level of maturity than linux containers. Linux is probably catching up now given the sheer weight of numbers of people using containers, but I still wouldn't trust them quite as much as BSD jails just yet; various kinds of flakiness and security vulnerabilities still seem relatively common.

hacknat 8y ago

At this point there really isn’t any security difference between zones, jails, and hardened containers. That word “hardened” is the key. Zones are a primitive in Illumos, containers are not a primitive in Linux, they are a collection of security features. If you use them all then you can achieve parity with Zones, but surprisingly few projects make use of all of them by default (Docker certainly doesn’t). The main difference then is usability, which is almost always the biggest security flaw in any piece of software (that the security isn’t “on” by default or has a prohibitive learning curve for the user).

posix_me_less 8y ago
> Docker certainly doesn’t Do you think LXD gets closer to Zones in terms of security?
- hacknat 8y ago
  Honestly, I don’t know, but my guess is that it had some things turned off by default. Actually K8s is the most encouraging project in this regard in that it has opinions about how containers should work so they are slowly adding all the secure options by default when containers are orchestrated to the various runtimes. There are only a few features left that remain to be turned on (user namespacing being the most notable).
  - technofiend 8y ago
    I paraphrased you by cutting down your comment, hope that's OK. >Actually K8s [...] are slowly adding all the secure options by default [...] (user namespacing being the most notable). K8's RBAC is nice, and in particular auth-delegator really helps with odd duck integration for the enterprise. But k8s is reliant on OS features to make user namespaces happen and Redhat customers are still waiting for Redhat to backport a newer version of shadow-utils [1] [2] to RHEL 7 so that user namespacing works there. Given enterprise certification and release cycles "Wait for RHEL 8" isn't really a good answer for those kind of customers. I'm not disagreeing with you, just saying some features of kubernetes aren't available everywhere. Personally I'd really like to see user namespaces come to RHEL 7 as it helps with removing or mitigating privileged access. [1] https://bugzilla.redhat.com/show_bug.cgi?id=1498628 https://bugzilla.redhat.com/show_bug.cgi?id=1498628 [2] https://access.redhat.com/solutions/3657531 https://access.redhat.com/solutions/3657531
qlk1123 8y ago
Just a weakly related comment here. When one talks about security, it's really hard for people to follow what she really means; the context has always been qualitative, but not quantitative. I found the idea "Vertical/Horizontal Attack Profile" interesting, which may help measure security when people argues different container solutions or even VMs. https://blog.hansenpartnership.com/measuring-the-horizontal-attack-profile-of-nabla-containers/ https://blog.hansenpartnership.com/measuring-the-horizontal-...

pdx6 8y ago

SmartOS has native ZFS support and zones.

rbanffy 8y ago
Isn't SmartOS and Illumos essentially the same OS?
- dijit 8y ago
  SmartOS is IllumOS derived. Much in the same way Linux has distributions; OpenSolaris has "spins". You don't install IllumOS, you install one of the distributions of it.
  - rbanffy 8y ago
    What are the differences between SmartOS and IllumOS WRT zones and ZFS?
    - dijit 8y ago
      The same difference for XFS between Linux and Ubuntu. IE; aside from minor differences in current version, nothing.

lmm 8y ago

> - Linux bad because BTRFS, so it's bad (well, you don't have to use it) The point is that there are no good filesystem options for Linux. ext4 has various issues mainly due to being ext2 underneath, reiserfs is unmaintained, xfs and jfs have no recovery tools at all (and xfs additionally has the trailing zeroes problem), and all of those require you to use a separate system for RAID for which Linux has no good options (true hardware RAID is expensive, BIOS RAID (dm-raid) and software RAID (md) will kick out disks during a rebuild if they see a single bad sector, which per https://www.zdnet.com/article/why-raid-6-stops-working-in-2019/ https://www.zdnet.com/article/why-raid-6-stops-working-in-20... is more likely than not with modern disk sizes. This risk is reduced (but not eliminated) by setting up regular scrubs, but tutorials and installation wizards don't always do that). BTRFS has issues up to and including data loss, userspace ZFS has major performance and reliability issues while in-kernel ZFS on Linux has substantial licensing concerns. > - BSD jails > anything on linux (I was hoping to see a clear outline of pros/cons, but the author's reasoning is very hard to follow, and the tone is very combative instead of constructive) Agreed that the writing is bad, but BSD jails do have a much higher level of maturity than linux containers. Linux is probably catching up now given the sheer weight of numbers of people using containers, but I still wouldn't trust them quite as much as BSD jails just yet; various kinds of flakiness and security vulnerabilities still seem relatively common.