5 ms·

Properly packaged Debian/raspbian apps are still an “apt install” away. Your use case, which is common, tells me that packaging / distributing may need some lov

Properly packaged Debian/raspbian apps are still an “apt install” away. Your use case, which is common, tells me that packaging / distributing may need some love, not that there’s a fundamental difference. And the convenience does not come free - a random docker is almost as bad as a random executable.

heavenlyblue 7y ago
>> Properly packaged >> packaging / distributing may need some love I am yet to see a single project which is relatively new and is packaged on Debian (let alone Raspbian). And lets be honest - nobody is genuinely using Raspberry Pi to run an outdated media server.
- beagle3 7y ago
  Debian unstable (and even testing) has many. Ubuntu PPAs do too. Raspbian might not, I don’t follow it.
vetinari 7y ago
Packaged and configured are two different things. The fun begins, when you need several applications, which each have different ideas about configuring services, that would be otherwise shared. Then, as a matter of convenience, you get packages, that either bundle everything preconfigured to their liking (i.e. gitlab omnibus) or packages, that configure shared services how they need it, and running them shared is not supported (i.e. freeipa, which will configure httpd as it needs and forget having anything else served on the same machine). Docker provides a way to isolate these, so you can still use the same resources you have to run applications, that would not cooperate with each other on a single machine, without having to run separate OS instances in separate VMs.
- beagle3 7y ago
  I mostly Ubuntu these days, have been for 15 years, and I cannot recall a time installing a package like Freeipa disabled a website installed by other packages. Obviously YMMv and I might have just been lucky.
  - vetinari 7y ago
    With freeipa I meant server, not client. Installing is not enough, configuring it into usable state is needed too (i.e. running freeipa-server-install or freeipa-replica-install). It is possible to run other services of such configured httpd, but you need to be careful. When freeipa wanted mod_nss, you had to use mod_nss, not mod_ssl (though they switched it); when freeipa wants to use gssproxy, you are going to use gssproxy too. These changes can happen during upgrades, and it is up to you to fix everything after such change. The project doesn't recommend to run anything else with the same server; you are free to try though. The point was, that with docker or another container system, any such problems are irrelevant, and it allows you to have separate service instances without having to run separate VMs.
debiandev 7y ago
> a random docker is almost as bad as a random executable You can sandbox a random executable with seccomp, you cannot effectively sandbox a whole container without breaking many things.
- raesene9 7y ago
  you know that Docker (by default) includes a seccomp filter as one of it's layers of isolation, right?
AnIdiotOnTheNet 7y ago
Packaging, in the way it is used in Linux, just needs to be taken out back and shot in the head. If it were any good at all, you wouldn't need so many package managers, package maintainers, repos, etc just to get software. You wouldn't have to worry about updates to your system conflicting with what's already installed, and you wouldn't have to compile things from source or juggle PPAs to get software in a timely manner direct from the developer. One of the reasons Docker is so popular is that it bypasses that garbage fire.
- beagle3 7y ago
  You don’t need so many package managers. they exist, but they are virtually equivalent these days. Docker is (almost) alone as a result of timeline. And the ppa juggling is somewhat accidental historical complexity, and some trust management issues. Non-official dockers in widespread use will, I believe, explode as a security nightmare sooner than later.
  - AnIdiotOnTheNet 7y ago
    And nobody cares. Because actually being able to use software, even if it is insecure, trumps not being able to use it.

heavenlyblue 7y ago

>> Properly packaged >> packaging / distributing may need some love I am yet to see a single project which is relatively new and is packaged on Debian (let alone Raspbian). And lets be honest - nobody is genuinely using Raspberry Pi to run an outdated media server.

beagle3 7y ago
Debian unstable (and even testing) has many. Ubuntu PPAs do too. Raspbian might not, I don’t follow it.

vetinari 7y ago

Packaged and configured are two different things. The fun begins, when you need several applications, which each have different ideas about configuring services, that would be otherwise shared. Then, as a matter of convenience, you get packages, that either bundle everything preconfigured to their liking (i.e. gitlab omnibus) or packages, that configure shared services how they need it, and running them shared is not supported (i.e. freeipa, which will configure httpd as it needs and forget having anything else served on the same machine). Docker provides a way to isolate these, so you can still use the same resources you have to run applications, that would not cooperate with each other on a single machine, without having to run separate OS instances in separate VMs.

beagle3 7y ago
I mostly Ubuntu these days, have been for 15 years, and I cannot recall a time installing a package like Freeipa disabled a website installed by other packages. Obviously YMMv and I might have just been lucky.
- vetinari 7y ago
  With freeipa I meant server, not client. Installing is not enough, configuring it into usable state is needed too (i.e. running freeipa-server-install or freeipa-replica-install). It is possible to run other services of such configured httpd, but you need to be careful. When freeipa wanted mod_nss, you had to use mod_nss, not mod_ssl (though they switched it); when freeipa wants to use gssproxy, you are going to use gssproxy too. These changes can happen during upgrades, and it is up to you to fix everything after such change. The project doesn't recommend to run anything else with the same server; you are free to try though. The point was, that with docker or another container system, any such problems are irrelevant, and it allows you to have separate service instances without having to run separate VMs.

debiandev 7y ago

> a random docker is almost as bad as a random executable You can sandbox a random executable with seccomp, you cannot effectively sandbox a whole container without breaking many things.

raesene9 7y ago
you know that Docker (by default) includes a seccomp filter as one of it's layers of isolation, right?

AnIdiotOnTheNet 7y ago

Packaging, in the way it is used in Linux, just needs to be taken out back and shot in the head. If it were any good at all, you wouldn't need so many package managers, package maintainers, repos, etc just to get software. You wouldn't have to worry about updates to your system conflicting with what's already installed, and you wouldn't have to compile things from source or juggle PPAs to get software in a timely manner direct from the developer. One of the reasons Docker is so popular is that it bypasses that garbage fire.

beagle3 7y ago
You don’t need so many package managers. they exist, but they are virtually equivalent these days. Docker is (almost) alone as a result of timeline. And the ppa juggling is somewhat accidental historical complexity, and some trust management issues. Non-official dockers in widespread use will, I believe, explode as a security nightmare sooner than later.
- AnIdiotOnTheNet 7y ago
  And nobody cares. Because actually being able to use software, even if it is insecure, trumps not being able to use it.