3 ms·

I don't disagree, per se, but how many Linux servers are out there running outdated software on a system that hasn't been patched in years because it's working

by bshipp 5y ago

I don't disagree, per se, but how many Linux servers are out there running outdated software on a system that hasn't been patched in years because it's working and stops working when updated? I love docker because I can treat the security of the system separately from the application. As long as I can update Docker with the system I can keep the root OS secure and work individually on each container service. I don't run the risk of updating the server and causing the app to puke. if I update the app and it pukes, I can roll back to the original container while I resolve the problem. In addition, all my services are slightly more isolated from the underlying OS, which limits exposure if an inherent security flaw is leveraged by a hacker. I guess I don't see why there is so much hate for docker.

goodpoint 5y ago
> but how many Linux servers are out there running outdated software on a system that hasn't been patched in years because it's working and stops working when updated? By the millions. If you work in security and do assessment for large companies you can find plenty. Then if you add non-Linux system it's order of magnitudes. > I can treat the security of the system separately from the application > all my services are slightly more isolated from the underlying OS, which limits exposure if an inherent security flaw Not at all. Docker has a huge attack surface compared to all the sandboxing systems that run rootless and without any daemon. Also, sandboxes/containers provide limited security and isolation anyways compared to VM. Furthermore, sandboxes are not alternatives to VMs. E.g. lot of OS services/daemons are sandboxed by default and at the same time the whole OS is deployed in a dedicated VM. Finally, tons of critical infrastructure runs on bare metal, with one service/application per device. Running a container there is a net negative for security.

by bshipp 5y ago

goodpoint 5y ago

> but how many Linux servers are out there running outdated software on a system that hasn't been patched in years because it's working and stops working when updated? By the millions. If you work in security and do assessment for large companies you can find plenty. Then if you add non-Linux system it's order of magnitudes. > I can treat the security of the system separately from the application > all my services are slightly more isolated from the underlying OS, which limits exposure if an inherent security flaw Not at all. Docker has a huge attack surface compared to all the sandboxing systems that run rootless and without any daemon. Also, sandboxes/containers provide limited security and isolation anyways compared to VM. Furthermore, sandboxes are not alternatives to VMs. E.g. lot of OS services/daemons are sandboxed by default and at the same time the whole OS is deployed in a dedicated VM. Finally, tons of critical infrastructure runs on bare metal, with one service/application per device. Running a container there is a net negative for security.