4 ms·

> Docker's value proposition is emphatically not security [...] It's the ability to deploy [...] gnarly and imperfect software This sounds like a recipe for di

by ptx 4y ago

> Docker's value proposition is emphatically not security [...] It's the ability to deploy [...] gnarly and imperfect software This sounds like a recipe for disaster to me and is why I haven't gotten into Docker. If the software being deployed is too complicated to build and install without Docker, but Docker doesn't provide secure isolation, how can you be sure that this "gnarly and imperfect" mess of a system is secure?

xvector 4y ago
Docker isn’t billed as a security solution but that doesn’t mean that it doesn’t come with some good defaults. You get some namespace/cgroup/seccomp/etc defaults OOTB which is still probably an improvement over what the organization currently has.
greiskul 4y ago
It's not about the software being complicated to install without Docker. It's about Docker making the installation process uniform no matter the software.
- cstrahan 4y ago
  I think you're missing the GP's point. What docker provides is a way to shrink-wrap a given build and all of its runtime dependencies. Despite popular misconception, what docker does not give you is a deterministic way to build that software. A Dockerfile provides the RUN steps necessary to build the software, but dependencies must still be fetched over the network, introducing non-determinism. You can spend 6 months happily using the latest release of some image, only to find that there's a critical bug or vulnerability that needs addressing ASAP. It kind of sucks for that complacency to turn to terror when you try to patch the software and rebuild, only to find inscrutable errors due to an absolutely bonkers build system. "ERR: Version A of Foo is incompatible with version B of Bar" Okay... but what happened here? What versions were we pulling before? Oh, the precise version isn't pinned in the build system, so.. I dunno. Great. It would really help if I knew if it was A that updated breaking B, or the reverse. Then multiply that by 1000x. And then add in (for Debian-esque base images) Apt repositories disappearing over time, git feature branches being deleted, tarballs falling off the edge of the internet, etc. Now, before someone says "well, that's on you if your Dockerfile obscures so much build non-determinism!" I agree with that statement! But that is a non sequitur with respect to the original premise: the build systems (and the web of dependencies they pull in) in third-party software you don't have ownership of is getting crazier and crazier, and Docker helps perpetuate this state of affairs, and the industry suffers as a whole.
  - pnt12 4y ago
    > Despite popular misconception, what docker does not give you is a deterministic way to build that software. I read an interesting thought: reproducibility is a spectrum. Docker isn't as reproducible as nix, but when used with version control and ci/cd, is damn more reproducible than zips with code and ftping them to servers.
Sohcahtoa82 4y ago
> how can you be sure that this "gnarly and imperfect" mess of a system is secure? You can't. But it's not like escaping a container is going to happen because of a simple bug. You need an exploitable vulnerability in the containerized app that creates a path to escaping the container. But yeah, if you want to isolate an app for security reasons, then you need a VM.
- ptx 4y ago
  Right, but if Docker allows us to package much more complicated applications (as opposed to being forced to simplify) that gives the bugs more room to hide and increases the risk of unforeseen interactions resulting in security bugs in the application. So what I'm trying to say is that making complicated applications easier to deploy doesn't seem like a win unless you also mitigate the increased security risk that comes with more complicated applications.

by ptx 4y ago

xvector 4y ago

Docker isn’t billed as a security solution but that doesn’t mean that it doesn’t come with some good defaults. You get some namespace/cgroup/seccomp/etc defaults OOTB which is still probably an improvement over what the organization currently has.

greiskul 4y ago

It's not about the software being complicated to install without Docker. It's about Docker making the installation process uniform no matter the software.

cstrahan 4y ago
I think you're missing the GP's point. What docker provides is a way to shrink-wrap a given build and all of its runtime dependencies. Despite popular misconception, what docker does not give you is a deterministic way to build that software. A Dockerfile provides the RUN steps necessary to build the software, but dependencies must still be fetched over the network, introducing non-determinism. You can spend 6 months happily using the latest release of some image, only to find that there's a critical bug or vulnerability that needs addressing ASAP. It kind of sucks for that complacency to turn to terror when you try to patch the software and rebuild, only to find inscrutable errors due to an absolutely bonkers build system. "ERR: Version A of Foo is incompatible with version B of Bar" Okay... but what happened here? What versions were we pulling before? Oh, the precise version isn't pinned in the build system, so.. I dunno. Great. It would really help if I knew if it was A that updated breaking B, or the reverse. Then multiply that by 1000x. And then add in (for Debian-esque base images) Apt repositories disappearing over time, git feature branches being deleted, tarballs falling off the edge of the internet, etc. Now, before someone says "well, that's on you if your Dockerfile obscures so much build non-determinism!" I agree with that statement! But that is a non sequitur with respect to the original premise: the build systems (and the web of dependencies they pull in) in third-party software you don't have ownership of is getting crazier and crazier, and Docker helps perpetuate this state of affairs, and the industry suffers as a whole.
- pnt12 4y ago
  > Despite popular misconception, what docker does not give you is a deterministic way to build that software. I read an interesting thought: reproducibility is a spectrum. Docker isn't as reproducible as nix, but when used with version control and ci/cd, is damn more reproducible than zips with code and ftping them to servers.

Sohcahtoa82 4y ago

> how can you be sure that this "gnarly and imperfect" mess of a system is secure? You can't. But it's not like escaping a container is going to happen because of a simple bug. You need an exploitable vulnerability in the containerized app that creates a path to escaping the container. But yeah, if you want to isolate an app for security reasons, then you need a VM.

ptx 4y ago
Right, but if Docker allows us to package much more complicated applications (as opposed to being forced to simplify) that gives the bugs more room to hide and increases the risk of unforeseen interactions resulting in security bugs in the application. So what I'm trying to say is that making complicated applications easier to deploy doesn't seem like a win unless you also mitigate the increased security risk that comes with more complicated applications.