3 ms·

> The compelling argument for FreeBSD has always been: zfs, pf and dtrace. You forgot to mention the "completeness" of the base system. Where Linux distributio

> The compelling argument for FreeBSD has always been: zfs, pf and dtrace. You forgot to mention the "completeness" of the base system. Where Linux distributions is a "mix and match" of various tools/versions, that may or may not be the same across each of them. FreeBSD provides a solid base that "just works". There's just one version (per release). Jails is also another great feature. Linux has cgroups and namespaces, with various tools built on top of it like Docker, LXC and LXD, but (IMO) Jails still beat them in a heartbeat by security and ease of use. Docker has had more severe vulnerabilities in a single year (2018 IIRC) than Jails has had in it's entire lifetime.

dijit 6y ago
I never saw docker as being built for security, I think it's a common concept that's attributed to them because "contain(ers)" sounds like it contains things, the reality is that they're talking about shipping containers pretty exclusively in the context of docker. Shipping containers are not secure.
- marios 6y ago
  But the content of shipping container #1 does not spill into shipping container #2. If it does, there's a problem. Similarly with software containers, you don't want data flowing into nearby containers (unless you do want that, in which case you have setup the necessary networking and that should be the only way for the containers in question to share data). I'm mostly interested in docker et al for the isolation aspect. The "ships the app with all its dependencies" is an interesting byproduct, although all too often it translates it means there's a mess in the amount of dependencies required. And that it's going to be an equal mess come update time -- unless of course the image is never updated in which case there's a chance the image becomes vulnerable (for example, outdated libssl).
  - 8fingerlouie 6y ago
    > I'm mostly interested in docker et al for the isolation aspect. The "ships the app with all its dependencies" is an interesting byproduct And that's why i use Jails instead (or LXC if you're on Linux). None of the layers. Any vulnerability is in the "base" image, and easily spotted, and can be hotfixed using normal package tools. Docker is a mess. Most containers consist of minimum 4 "base images", each of which can contain vulnerabilities. All done to save the "overhead" of installing Python on top of a base Debian image, or whatever your flavor of poison is. Instead i use Ansible for reproducibility, and scripts for updating/upgrading. Another advantage to jails is that they're just plain directories in a hosts filesystem, allowing existing vulnerability scanners to scan the entire stack from a single host, instead of using containers that needs to be scanned individually.

dijit 6y ago

I never saw docker as being built for security, I think it's a common concept that's attributed to them because "contain(ers)" sounds like it contains things, the reality is that they're talking about shipping containers pretty exclusively in the context of docker. Shipping containers are not secure.

marios 6y ago
But the content of shipping container #1 does not spill into shipping container #2. If it does, there's a problem. Similarly with software containers, you don't want data flowing into nearby containers (unless you do want that, in which case you have setup the necessary networking and that should be the only way for the containers in question to share data). I'm mostly interested in docker et al for the isolation aspect. The "ships the app with all its dependencies" is an interesting byproduct, although all too often it translates it means there's a mess in the amount of dependencies required. And that it's going to be an equal mess come update time -- unless of course the image is never updated in which case there's a chance the image becomes vulnerable (for example, outdated libssl).
- 8fingerlouie 6y ago
  > I'm mostly interested in docker et al for the isolation aspect. The "ships the app with all its dependencies" is an interesting byproduct And that's why i use Jails instead (or LXC if you're on Linux). None of the layers. Any vulnerability is in the "base" image, and easily spotted, and can be hotfixed using normal package tools. Docker is a mess. Most containers consist of minimum 4 "base images", each of which can contain vulnerabilities. All done to save the "overhead" of installing Python on top of a base Debian image, or whatever your flavor of poison is. Instead i use Ansible for reproducibility, and scripts for updating/upgrading. Another advantage to jails is that they're just plain directories in a hosts filesystem, allowing existing vulnerability scanners to scan the entire stack from a single host, instead of using containers that needs to be scanned individually.