3 ms·

The real problem is that the docker monoculture discourage good dependency management making packaging very difficult. The first victim is security. Linux dis

The real problem is that the docker monoculture discourage good dependency management making packaging very difficult. The first victim is security. Linux distributions like Debian do stable releases and painstakingly backport security fixes to give you both feature stability and security improvements *at the same time*. The cultures of docker and of static linking makes this increasingly difficult every day. The result is a world where you can only chose between: - update to the latest release of an application or a library used in a build: Lose feature stability and get newly introduced security issues. - keep an old container or fat binary around, with all the known security issues unfixed. Needles to say, this is completely untenable in many high-risk environments. Banks, Health, industrial automation, avionics, trains, cars, military, and so on.

bshipp 5y ago
I don't disagree, per se, but how many Linux servers are out there running outdated software on a system that hasn't been patched in years because it's working and stops working when updated? I love docker because I can treat the security of the system separately from the application. As long as I can update Docker with the system I can keep the root OS secure and work individually on each container service. I don't run the risk of updating the server and causing the app to puke. if I update the app and it pukes, I can roll back to the original container while I resolve the problem. In addition, all my services are slightly more isolated from the underlying OS, which limits exposure if an inherent security flaw is leveraged by a hacker. I guess I don't see why there is so much hate for docker.
- goodpoint 5y ago
  > but how many Linux servers are out there running outdated software on a system that hasn't been patched in years because it's working and stops working when updated? By the millions. If you work in security and do assessment for large companies you can find plenty. Then if you add non-Linux system it's order of magnitudes. > I can treat the security of the system separately from the application > all my services are slightly more isolated from the underlying OS, which limits exposure if an inherent security flaw Not at all. Docker has a huge attack surface compared to all the sandboxing systems that run rootless and without any daemon. Also, sandboxes/containers provide limited security and isolation anyways compared to VM. Furthermore, sandboxes are not alternatives to VMs. E.g. lot of OS services/daemons are sandboxed by default and at the same time the whole OS is deployed in a dedicated VM. Finally, tons of critical infrastructure runs on bare metal, with one service/application per device. Running a container there is a net negative for security.

bshipp 5y ago

I don't disagree, per se, but how many Linux servers are out there running outdated software on a system that hasn't been patched in years because it's working and stops working when updated? I love docker because I can treat the security of the system separately from the application. As long as I can update Docker with the system I can keep the root OS secure and work individually on each container service. I don't run the risk of updating the server and causing the app to puke. if I update the app and it pukes, I can roll back to the original container while I resolve the problem. In addition, all my services are slightly more isolated from the underlying OS, which limits exposure if an inherent security flaw is leveraged by a hacker. I guess I don't see why there is so much hate for docker.

goodpoint 5y ago
> but how many Linux servers are out there running outdated software on a system that hasn't been patched in years because it's working and stops working when updated? By the millions. If you work in security and do assessment for large companies you can find plenty. Then if you add non-Linux system it's order of magnitudes. > I can treat the security of the system separately from the application > all my services are slightly more isolated from the underlying OS, which limits exposure if an inherent security flaw Not at all. Docker has a huge attack surface compared to all the sandboxing systems that run rootless and without any daemon. Also, sandboxes/containers provide limited security and isolation anyways compared to VM. Furthermore, sandboxes are not alternatives to VMs. E.g. lot of OS services/daemons are sandboxed by default and at the same time the whole OS is deployed in a dedicated VM. Finally, tons of critical infrastructure runs on bare metal, with one service/application per device. Running a container there is a net negative for security.