4 ms·
> I really dislike when people assume containers give them security, it’s the wrong thing to think about. to be fair, there is lots of published text around su
by foxhill 5y ago
> I really dislike when people assume containers give them security, it’s the wrong thing to think about.
to be fair, there is lots of published text around suggesting that this _is_ the case. many junior to semi-experienced engineers i've known have at some point thought it's plausible to "ssh into" a container. they're seen as light-weight VMs, not as what they are - processes.
> Containers allowed us to deploy reproducibly, that’s powerful.
and it was done in the most "to bake an apple pie from scratch, you must first create the universe" approach.
- mikeyjk 5y agoIt is possible to do that though. I'm perhaps getting too caught up on 'plausible'.
- phire 5y agoBut you can ssh into a container. You just need to install sshd and launch it. You also need to create a user and set a password if you want to actually log in. Why? Because containers aren't a single process. It's a group of processes sharing a namespace. And you can totally use a container as a light-weight VM. While most containers have bash or a your application as pid 1, there is nothing stopping you launching a proper initrd as pid 1 and it will act much like a proper OS. Though, just because you can, doesn't mean you should.
- otterley 5y agoI think you mean init, not initrd. An initrd is a RAM disk image loaded by Linux containing kernel file system and network drivers and is typically used to help minimize the size of the main kernel image.