4 ms·

Indeed. I'm still holding off, in the hope it will go away (like Openstack), but it does seem like it has some more stamina as a project.

by Nux 7y ago

arvinsim 7y ago
Sticking to Docker for local projects for now
- marshmellowtest 7y ago
  No thanks. It's a huge security dumpster fire as well.
  - vpEfljFL 7y ago
    Could you elaborate please and what approach do you recommend?
    - zxcvou 7y ago
      containers in general are horrible wrt security because they are architecturally flawed - they pretend to have some sort of 'isolation' but that was crap docker marketing people just made up - there is no isolation - k8s pushes this agenda further by declaring that multi-tenant workloads are perfectly normal and ok for containers which they absolutely are not just look at the CVEs from recent years: * docker doomsday * escaping like a rkt * cryptojacking? - that didn't even exist until containers were here!
  - pepemon 7y ago
    Well if you're uncomfortable with its priviged daemon, you can always switch to CRI-O with Red Hat tooling for it. But for all my years with Docker as the container runtime, all security related problems have occured within the backend code, not Docker, not Linux cgroups, not Linux itself.
    - freedomben 7y ago
      I've worked with some big customers in the financial industry, and this is exactly what we do. Podman implements the same CLI as docker, so you can basically just `s/docker/podman/g` (as long as you don't use docker-compose). It's also a lot easier to debug and see what's happening without that daemon sitting in the middle of all the traditional linux tools.
anonsivalley652 7y ago
OpenStack didn't go away for large users who need to run IaaS/*aaS. OpenStack codebase is/was a giant, warm pile, but honestly k8s isn't all that either. I've heard and seen tons of k8s horror stories, I won't touch it. Give me Xen/KVM/ESXi to chop up a large box into a virtual lab and then Docker inside that on a custom Docker VM. These giant, support everything (poorly) "solutions" aren't all that helpful. The problem of hype is that it's usually to evangelize marginal projects while better ones march along in obscurity.
pepemon 7y ago
Kubernetes is a nice choice for specific usecases (like, well, battle-tested container orchestrating & scheduling), but overhyping it with references like "Kubernetes is a data center operating system" is absolute mess, IMO. You can't put everything in Kubernetes. And it's also applies to OpenStack which is more than alive. While its ecosystem consists of horde of different solutions, plain nova/neutron/cinder are matured and efficient solutions to roll your own private IaaS.

Indeed. I'm still holding off, in the hope it will go away (like Openstack), but it does seem like it has some more stamina as a project.

by Nux 7y ago

Indeed. I'm still holding off, in the hope it will go away (like Openstack), but it does seem like it has some more stamina as a project.

arvinsim 7y ago

Sticking to Docker for local projects for now

marshmellowtest 7y ago
No thanks. It's a huge security dumpster fire as well.
- vpEfljFL 7y ago
  Could you elaborate please and what approach do you recommend?
  - zxcvou 7y ago
    containers in general are horrible wrt security because they are architecturally flawed - they pretend to have some sort of 'isolation' but that was crap docker marketing people just made up - there is no isolation - k8s pushes this agenda further by declaring that multi-tenant workloads are perfectly normal and ok for containers which they absolutely are not just look at the CVEs from recent years: * docker doomsday * escaping like a rkt * cryptojacking? - that didn't even exist until containers were here!
- pepemon 7y ago
  Well if you're uncomfortable with its priviged daemon, you can always switch to CRI-O with Red Hat tooling for it. But for all my years with Docker as the container runtime, all security related problems have occured within the backend code, not Docker, not Linux cgroups, not Linux itself.
  - freedomben 7y ago
    I've worked with some big customers in the financial industry, and this is exactly what we do. Podman implements the same CLI as docker, so you can basically just `s/docker/podman/g` (as long as you don't use docker-compose). It's also a lot easier to debug and see what's happening without that daemon sitting in the middle of all the traditional linux tools.

anonsivalley652 7y ago

OpenStack didn't go away for large users who need to run IaaS/*aaS. OpenStack codebase is/was a giant, warm pile, but honestly k8s isn't all that either. I've heard and seen tons of k8s horror stories, I won't touch it. Give me Xen/KVM/ESXi to chop up a large box into a virtual lab and then Docker inside that on a custom Docker VM. These giant, support everything (poorly) "solutions" aren't all that helpful. The problem of hype is that it's usually to evangelize marginal projects while better ones march along in obscurity.

pepemon 7y ago

Kubernetes is a nice choice for specific usecases (like, well, battle-tested container orchestrating & scheduling), but overhyping it with references like "Kubernetes is a data center operating system" is absolute mess, IMO. You can't put everything in Kubernetes. And it's also applies to OpenStack which is more than alive. While its ecosystem consists of horde of different solutions, plain nova/neutron/cinder are matured and efficient solutions to roll your own private IaaS.