3 ms·

Docker's easier and does all the same stuff. It's integrated with everything else, has an interface everyone is familiar with, uses OCIs, is extensible, is supp

Docker's easier and does all the same stuff. It's integrated with everything else, has an interface everyone is familiar with, uses OCIs, is extensible, is supported on basically every platform, has a simpler config file, tons of community support, and now runs rootless. Does anyone have a use case where they couldn't use Docker? I'm sure they exist but the list must be tiny. Listed in the article is: - run systemd in a container - why?? does your system not have systemd or equivalent? - bad design; how will you monitor what's running and what's not, or upgrade an individual service in this container? restart everything? - apparently systemd can run in docker?? https://medium.com/swlh/docker-and-systemd-381dfd7e4628 - run lxc/docker in a container - docker-in-docker

p4bl0 4y ago
I teach an introduction to computer security course where I show my students how to write some basic rootkits for Linux. I need them to be able do that on the computer room machines (where they aren't root not sudoers), or on their own computer, but in both case I prefer if it doesn't cause a kernel panic if their code is wrong at some point. As far as I know you cannot load kernel modules in a container. You need an actual VM for that.
- jlokier 4y ago
  VMs are perfect for that teaching scenario. That said, you're not supposed to be able to load kernel modules from a container. Which is exactly the sort of idea an enterprising rootkit author might think to take advantage of ;-) You might consider asking your students if they can figure out how they might go about getting a kernel module installed from in a container despite it not being allowed - and what advantages does that bring to the rootkit author. If necessary, you can test it using an LXD container in a VM.
rcarmo 4y ago
It doesn’t do the same thing. LXC is a godsend when you need sandboxing other users or workloads that spill over into the host (even Docker stacks need (Host) resources, like mount points and storage). I run different Docker Compose stacks inside different LXC containers to avoid collisions between some containers that are in both stacks.

p4bl0 4y ago

I teach an introduction to computer security course where I show my students how to write some basic rootkits for Linux. I need them to be able do that on the computer room machines (where they aren't root not sudoers), or on their own computer, but in both case I prefer if it doesn't cause a kernel panic if their code is wrong at some point. As far as I know you cannot load kernel modules in a container. You need an actual VM for that.

jlokier 4y ago
VMs are perfect for that teaching scenario. That said, you're not supposed to be able to load kernel modules from a container. Which is exactly the sort of idea an enterprising rootkit author might think to take advantage of ;-) You might consider asking your students if they can figure out how they might go about getting a kernel module installed from in a container despite it not being allowed - and what advantages does that bring to the rootkit author. If necessary, you can test it using an LXD container in a VM.

rcarmo 4y ago

It doesn’t do the same thing. LXC is a godsend when you need sandboxing other users or workloads that spill over into the host (even Docker stacks need (Host) resources, like mount points and storage). I run different Docker Compose stacks inside different LXC containers to avoid collisions between some containers that are in both stacks.