3 ms·

But he had to migrate away from FreeBSD to use Docker, so that doesn't sound like a portability advantage at all, in the usual sense of the word "portability".

But he had to migrate away from FreeBSD to use Docker, so that doesn't sound like a portability advantage at all, in the usual sense of the word "portability". "Improved security" is also a red herring. You can't make something more secure by adding an additional layer of abstraction. He even mentions that he found it problematic that inside the Docker container, everything runs as root by default. Plus the dicker daemon must needlessly run as root on the host.

viraptor 8y ago
> he found it problematic that inside the Docker container, everything runs as root by default That's technically right, but not what you'd expect. Docker runs root in a few restricted namespaces and behind seccomp by default. The syscall exploits people are worried about are often simply not available. Even then it's easy to take it another step and create new users. You could even have root mapped to a different user on the outside if you prefer that. That shouldn't be an issue if you're coming from FreeBSD - https://www.freebsd.org/doc/en/articles/new-users/adding-a-user.html https://www.freebsd.org/doc/en/articles/new-users/adding-a-u... > If you did not create any users when you installed the system and are thus logged in as root, you should probably create a user now with ...
rsync 8y ago
""Improved security" is also a red herring. You can't make something more secure by adding an additional layer of abstraction." I have not used docker. However, I have been putting things in containers with FreeBSD 'jail' since 2001 ... If I jail my httpd and there is a vuln in the httpd, the attacker gets the jail (and the httpd, etc.) but not the underlying system. That's a huge win, in my mind - is that not how it works in dockerland ?
- weberc2 8y ago
  Last I checked, Docker containers are not hard to break out of unless you go to extra lengths (SELinux, AppArmor, etc--not entirely sure; I'm not an expert). Most people use Docker as a way to avoid their programs accessing the wrong version of a shared dependency or similar. I believe there may be other container runtimes with stronger guarantees or better defaults, some of which are even suitable for running untrusted code (or so they advertise).
  - rsync 8y ago
    Thanks - good to know. jail is pretty tremendous - a real win in many areas.

viraptor 8y ago

> he found it problematic that inside the Docker container, everything runs as root by default That's technically right, but not what you'd expect. Docker runs root in a few restricted namespaces and behind seccomp by default. The syscall exploits people are worried about are often simply not available. Even then it's easy to take it another step and create new users. You could even have root mapped to a different user on the outside if you prefer that. That shouldn't be an issue if you're coming from FreeBSD - https://www.freebsd.org/doc/en/articles/new-users/adding-a-user.html https://www.freebsd.org/doc/en/articles/new-users/adding-a-u... > If you did not create any users when you installed the system and are thus logged in as root, you should probably create a user now with ...

rsync 8y ago

""Improved security" is also a red herring. You can't make something more secure by adding an additional layer of abstraction." I have not used docker. However, I have been putting things in containers with FreeBSD 'jail' since 2001 ... If I jail my httpd and there is a vuln in the httpd, the attacker gets the jail (and the httpd, etc.) but not the underlying system. That's a huge win, in my mind - is that not how it works in dockerland ?

weberc2 8y ago
Last I checked, Docker containers are not hard to break out of unless you go to extra lengths (SELinux, AppArmor, etc--not entirely sure; I'm not an expert). Most people use Docker as a way to avoid their programs accessing the wrong version of a shared dependency or similar. I believe there may be other container runtimes with stronger guarantees or better defaults, some of which are even suitable for running untrusted code (or so they advertise).
- rsync 8y ago
  Thanks - good to know. jail is pretty tremendous - a real win in many areas.