4 ms·
> Is there a good reason why they don't seem widely adopted? TBH their docs aren't that great. There should probably be a 'curl | sh' solution to install it at
by insanitybit 3y ago
> Is there a good reason why they don't seem widely adopted?
TBH their docs aren't that great. There should probably be a 'curl | sh' solution to install it at the top of the readme followed by a '<run this command and you're in an ubuntu shell in kata!>' command right after.
Another issue is the lack of nested virtualization in EC2 instances that aren't the very expensive i3 metals. That turns this from a "it's a drop in replacement" to "I'm spending thousands of dollars on this".
- PurelyApplied 3y agoThere should be a `curl | sh` in this, a security-oriented product? To demonstrate how badly you need it, perhaps? Please don't pipe the Internet directly into your command line.
- HL33tibCe7 3y agoAh yes, because using a package manager to pipe the internet directly into our computer instead is so much better.
- nicce 3y agoYes. Proper package manager usually proceeds to install only signed packages. It means that usually OS maintainer has verified the purpose of the package. It gives a quite lot more trust than running arbitrary content as shell script, without any third party verification.
- HL33tibCe7 3y agoVerified using a public key that you acquire over HTTPS, the exact same channel that you trust with curl | sh
- nicce 3y agoFrom above: > , without any third party verification. Certificate provider does not verify packages nor anything what is coming from there. Server even might be just proxy.
- HL33tibCe7 3y agoThe exact same problem exists with the channel that you acquire the public key you trust from. You’re still fundamentally trusting HTTPS to the package provider - you’re just trusting it at a different point.
- nicce 3y agoUsually keyring is separate package which is also signed with a key which can be verified from multiple different sources. Of course, if you are a target of nation state attack, which fakes public keys from all sources by MITMn DNSs and servers, you might end up with the wrong package. But that threat model is totally different.
- misnome 3y agoUntil you want to use software that it doesn't have, and then you are adding third-party repositories. Which is still just code from the internet.
- insanitybit 3y agoI feel like "curl | sh is fine" has been explained so many times at this point idk how people still aren't on the same page. If you hate "curl | sh" so much I'm sure they can provide some other method of installation.
- rwmj 3y agoThe proposed solution to the nested virtualization problem (apart from somehow persuading Amazon to switch that on) is something called peer pods, where the containers run in separate AWS instances. Arranging the traffic between the peer pods and the instance which is acting as host is quite challenging and I've never seen this successfully deployed in production. https://www.redhat.com/en/blog/red-hat-openshift-sandboxed-containers-peer-pods-solution-overview https://www.redhat.com/en/blog/red-hat-openshift-sandboxed-c...