3 ms·

I don’t have to go docker or kubernetes path for anything complex. I can still use more secure lxd containers with the same system configuration tool and script

I don’t have to go docker or kubernetes path for anything complex. I can still use more secure lxd containers with the same system configuration tool and scripts used for VM, bare metal to manage container. Indeed due to problem with docker and CRI all kubernetes were vulnerable recently and needed security patch, as docker containers do not run in user namespace like lxd. So for HA also traditional methods are better and functional programming approach like guix and nix to generate lxd container images, vm images or deploy to bare metal to run application is far superior and secure instead of spaghetti and non understandable black box images popular in docker world.

fapjacks 7y ago
You have either deliberately misrepresented "Docker" in your post, or don't know enough about the vulnerability (and the affected software, runc) to make the claims you are making. The vulnerability was in runc, and Docker et al have had the capability to utilize user namespaces for a number of years.
- dragonsh 7y ago
  No I did not mis-represent docker, used it since version 0.96 and after 1.0. Also commented, when under the new investment it tried to re-invent the wheels by moving away from lxc base to re-write its own libcontainer and lost on the development of unprivileged containers which landed in lxc 1.0. Since than it’s always been a security nightmare. Docker although inferior and less secure than LXC/LXD became popular due to marketing driven by VC money, not on technical merits. Check the old thread discussing the security issue with docker not supporting unprivileged container. [1] [1] https://news.ycombinator.com/item?id=20487625 https://news.ycombinator.com/item?id=20487625