5 ms·

I've given up on expecting sane defaults from every piece of software. Some packages work perfectly fine out of the box, or simply work not at peak performance

by heipei 7y ago

I've given up on expecting sane defaults from every piece of software. Some packages work perfectly fine out of the box, or simply work not at peak performance if not tuned slightly. Other software has so many dangerous default settings that it's hard to understand the rationale. Case in point for me is Docker itself. By default it will write logs to json-file and not truncate or rotate these logs. Packages distributed for Ubuntu et al also don't set these limits, so unless you manually make it a system-wide default or set it for each container you run individually it will eventually eat your disk-space. This is a very dangerous setting since you're probably using Docker in a lot of cases where all you do is run ephemeral, stateless workloads. Having out-of-disk creep up on you on these kind of hosts is most unexpected. The same could be said of having the -p port forwarding option default to binding to 0.0.0.0 instead of 127.0.0.1. Also a footgun and an exposed ElasticSearch with PII waiting to happen...

davesmith1983 7y ago
I install PHP on my server (yeah I know) to run some PHP based web based software. By default PHP is configured in a very insecure manner. You would think with all the security problems that they would ship it with a set of secure defaults.
- overcast 7y ago
  Problem with setting secure defaults, is that most of the worlds PHP would stop working properly.
  - davesmith1983 7y ago
    Probably but you can still have the configuration secure as default and people would be aware of the security implications when enabling insecure features.
    - naniwaduni 7y ago
      No, that would be a breaking change.
      - AlphaSite 7y ago
        Java did that with modules and it appears to have worked ok for them.
    - overcast 7y ago
      You're vastly overestimating the technical capabilities of the average person installing or creating software.
      - davesmith1983 7y ago
        I am talking about whoever is packaging PHP for the OS, there is a default php.ini that comes with PHP on CentOS is insecure by default (I can't remember off the top of my head which settings were set to something insecure). We are talking about an ini file. This isn't rocket science.
        overcast 7y ago
        Right, but they need to be conscious of their end user. If they secure by default, and someone upgrades, their software stops working. Should PHP have had these defaults to begin with, yes absolutely. But now we're all stuck with a million miles of code that will break if register_globals is turned off. That's the point. Everything you've stated above there might as well be an alien language to the majority of people using this stuff.
        davesmith1983 7y ago
        No it should be secure by default and people will have to enable insecure features. It doesn't stop old software from working as the person will be able to simply re-enable whatever the insecure feature is. However they will now be aware that said feature is insecure and should know the consequences of enabling it.
sandGorgon 7y ago
Could you point to some of the sane configuration for docker? We are planning to run some of these in production.
- heipei 7y ago
  For the logging aspect it's funny because the Docker manual itself contains a good snippet with reasonable settings: https://docs.docker.com/config/containers/logging/configure/ https://docs.docker.com/config/containers/logging/configure/ For the port-binding thing, I'd just remember that it binds to 0.0.0.0 when not explicitly specified otherwise, and then use docker network and not port-forwards unless absolutely needed. For example, if you have an application and a couple of backing services (database, redis, ElasticSearch), then only your application needs a port forwarded from the host, the rest can live within the docker network.
  - rmetzler 7y ago
    Setting up a firewall like ufw could prevent accidental port mapping to 0.0.0.0. I really don’t like that this is Docker‘s default.
    - kozziollek 7y ago
      Last time I checked (~year ago) Docker used different iptables chain(s) than ufw or added itself before ufw rules, so ufw was useless in securing access to ports exposed by containers.
      - rmetzler 7y ago
        Ok, thanks for the heads up, I'm going to test this.
- programd 7y ago
  This is really the million dollar question. Right now I'm not aware of any single cookbook example of how to tune your server for an optimal docker load. It's all buried inside engineering organizations, or blog posts like the one here. One of the things the MySQL developers did originally was to ship the code with three examples of the my.cnf config file for small, medium and large memory systems. I wish there was something like that for docker container density and OS tuning parameters. I think what we need is basically a matrix of OS settings which will max out your docker density for N CPUs and M gigs of memory. There are also probably settings for network configs which depend on your link capacity also. I can dream of a day when you can spin up an Ubuntu Docker-flavor server which optimizes itself to give the highest density of containers given the hardware (or VM) it's running on.
techntoke 7y ago
It is really up to package maintainers, so rather than give up, why not try to contribute back?
cpuguy83 7y ago
Would love to change this default but doing so will end up breaking Kubernetes users at the very least Maybe we could change the default based on api version.

by heipei 7y ago

davesmith1983 7y ago

I install PHP on my server (yeah I know) to run some PHP based web based software. By default PHP is configured in a very insecure manner. You would think with all the security problems that they would ship it with a set of secure defaults.

overcast 7y ago
Problem with setting secure defaults, is that most of the worlds PHP would stop working properly.
- davesmith1983 7y ago
  Probably but you can still have the configuration secure as default and people would be aware of the security implications when enabling insecure features.
  - naniwaduni 7y ago
    No, that would be a breaking change.
    - AlphaSite 7y ago
      Java did that with modules and it appears to have worked ok for them.
  - overcast 7y ago
    You're vastly overestimating the technical capabilities of the average person installing or creating software.
    - davesmith1983 7y ago
      I am talking about whoever is packaging PHP for the OS, there is a default php.ini that comes with PHP on CentOS is insecure by default (I can't remember off the top of my head which settings were set to something insecure). We are talking about an ini file. This isn't rocket science.
      - overcast 7y ago
        Right, but they need to be conscious of their end user. If they secure by default, and someone upgrades, their software stops working. Should PHP have had these defaults to begin with, yes absolutely. But now we're all stuck with a million miles of code that will break if register_globals is turned off. That's the point. Everything you've stated above there might as well be an alien language to the majority of people using this stuff.
        davesmith1983 7y ago
        No it should be secure by default and people will have to enable insecure features. It doesn't stop old software from working as the person will be able to simply re-enable whatever the insecure feature is. However they will now be aware that said feature is insecure and should know the consequences of enabling it.

sandGorgon 7y ago

Could you point to some of the sane configuration for docker? We are planning to run some of these in production.

heipei 7y ago
For the logging aspect it's funny because the Docker manual itself contains a good snippet with reasonable settings: https://docs.docker.com/config/containers/logging/configure/ https://docs.docker.com/config/containers/logging/configure/ For the port-binding thing, I'd just remember that it binds to 0.0.0.0 when not explicitly specified otherwise, and then use docker network and not port-forwards unless absolutely needed. For example, if you have an application and a couple of backing services (database, redis, ElasticSearch), then only your application needs a port forwarded from the host, the rest can live within the docker network.
- rmetzler 7y ago
  Setting up a firewall like ufw could prevent accidental port mapping to 0.0.0.0. I really don’t like that this is Docker‘s default.
  - kozziollek 7y ago
    Last time I checked (~year ago) Docker used different iptables chain(s) than ufw or added itself before ufw rules, so ufw was useless in securing access to ports exposed by containers.
    - rmetzler 7y ago
      Ok, thanks for the heads up, I'm going to test this.
programd 7y ago
This is really the million dollar question. Right now I'm not aware of any single cookbook example of how to tune your server for an optimal docker load. It's all buried inside engineering organizations, or blog posts like the one here. One of the things the MySQL developers did originally was to ship the code with three examples of the my.cnf config file for small, medium and large memory systems. I wish there was something like that for docker container density and OS tuning parameters. I think what we need is basically a matrix of OS settings which will max out your docker density for N CPUs and M gigs of memory. There are also probably settings for network configs which depend on your link capacity also. I can dream of a day when you can spin up an Ubuntu Docker-flavor server which optimizes itself to give the highest density of containers given the hardware (or VM) it's running on.

techntoke 7y ago

It is really up to package maintainers, so rather than give up, why not try to contribute back?

cpuguy83 7y ago

Would love to change this default but doing so will end up breaking Kubernetes users at the very least Maybe we could change the default based on api version.