3 ms·
Simple: I never target specific CPUs to begin with ;) I'm only half joking. I'm of the group of people who know that Docker is a security nightmare unless you'
by johnklos 4y ago
Simple: I never target specific CPUs to begin with ;)
I'm only half joking. I'm of the group of people who know that Docker is a security nightmare unless you're generating your Docker images yourself, so wherever I've had to support that, I insist on that. If you don't use software that's either processor centric (and therefore buggy, IMHO) or binary-only, then this is straightforward and a win for everyone.
Run x86 and amd64 VMs on real x86 and amd64 servers, and access them remotely, like we've done since the beginning of time (teletypes predate stored program electronic computers).
Since Docker is x86 / amd64 centric, treat it like the snowflake it is, and run it on x86 / amd64.
- danudey 4y agoCan you elaborate on what part of docker is a security nightmare?
- kccqzy 4y agoDockerd is a daemon that runs with very high privileges and does too many things. People hate using "sudo docker" so they add themselves to the docker group. Now congratulations you are effectively running as root all the time.
- ccouzens 4y agoOn Windows and Mac docker is run in a virtual machine without full access to the host's files so root is less of a problem. Even though docker runs natively on Linux, perhaps a similar vm setup can be achieved for security reasons. I use Podman on Linux which is compatible with docker but without the root issue.
- znpy 4y agoThere’s podman for that, it runs in rootless mode very well.