4 ms·

At this point, it seems simpler to run OpenShift, which is essentially Kubernetes + extra stuff you don't have to use + nicer console. If you go with Red Hat, y

At this point, it seems simpler to run OpenShift, which is essentially Kubernetes + extra stuff you don't have to use + nicer console. If you go with Red Hat, you get a number of benefits, such as not being affected by the recent 'Doomsday bug' in docker that wasn't really that doomsday-ish. Does Google actually support self-hosted Kubernetes?

specto 8y ago
They're going to, it's in private beta apparently https://cloud.google.com/gke-on-prem/ https://cloud.google.com/gke-on-prem/
shaklee3 8y ago
How are you not affected? https://access.redhat.com/security/vulnerabilities/runcescape https://access.redhat.com/security/vulnerabilities/runcescap...
- BossingAround 8y ago
  Check out [1], more specifically: "For many Red Hat end users, it’s unlikely that this flaw gets that far. IT organizations using Red Hat Enterprise Linux to underpin their Linux container and cloud-native deployments are likely protected, thanks to SELinux." [1] https://www.redhat.com/en/blog/it-starts-linux-how-red-hat-helping-counter-linux-container-security-flaws https://www.redhat.com/en/blog/it-starts-linux-how-red-hat-h...
  - vertex-four 8y ago
    SELinux exists in other distros.
    - ofrzeta 8y ago
      It does, but is it a first-class citizen as it is in RHEL and CentOS? Also OpenShift is finely tuned to run with SELinux. This is something you would have to do yourself on another platform with, say, Kubernetes and SELinux.
    - BossingAround 8y ago
      I was just saying that instead of all the hassle of going into production with self-supported, on-prem Kubernetes on top of some new-ish distro, the sane way seems to go with Red Hat's Kubernetes on top of a battle-tested distro with extra security features that is all supported. If you want to run your prod workloads on self-supported Kubernetes with SELinux and similar features yourself, sure you could do that. Is that sane? I'll leave that as an exercise for the reader. What do I know, maybe it is.
- ofrzeta 8y ago
  Because "This vulnerability is mitigated on Red Hat Enterprise Linux 7 if SELinux is in enforcing mode." Which is the default when you install OpenShift - opposed to a gazillion of server software packages that advise you to deactivate SELinux.

specto 8y ago

They're going to, it's in private beta apparently https://cloud.google.com/gke-on-prem/ https://cloud.google.com/gke-on-prem/

shaklee3 8y ago

How are you not affected? https://access.redhat.com/security/vulnerabilities/runcescape https://access.redhat.com/security/vulnerabilities/runcescap...

BossingAround 8y ago
Check out [1], more specifically: "For many Red Hat end users, it’s unlikely that this flaw gets that far. IT organizations using Red Hat Enterprise Linux to underpin their Linux container and cloud-native deployments are likely protected, thanks to SELinux." [1] https://www.redhat.com/en/blog/it-starts-linux-how-red-hat-helping-counter-linux-container-security-flaws https://www.redhat.com/en/blog/it-starts-linux-how-red-hat-h...
- vertex-four 8y ago
  SELinux exists in other distros.
  - ofrzeta 8y ago
    It does, but is it a first-class citizen as it is in RHEL and CentOS? Also OpenShift is finely tuned to run with SELinux. This is something you would have to do yourself on another platform with, say, Kubernetes and SELinux.
  - BossingAround 8y ago
    I was just saying that instead of all the hassle of going into production with self-supported, on-prem Kubernetes on top of some new-ish distro, the sane way seems to go with Red Hat's Kubernetes on top of a battle-tested distro with extra security features that is all supported. If you want to run your prod workloads on self-supported Kubernetes with SELinux and similar features yourself, sure you could do that. Is that sane? I'll leave that as an exercise for the reader. What do I know, maybe it is.
ofrzeta 8y ago
Because "This vulnerability is mitigated on Red Hat Enterprise Linux 7 if SELinux is in enforcing mode." Which is the default when you install OpenShift - opposed to a gazillion of server software packages that advise you to deactivate SELinux.