4 ms·

> docker doesn't create an overhead by itself Yes it does, the Docker runtime (the daemon which runs under root) is horribly designed and insecure.

Timber-6539 2y ago
Insecure in what way? Rootful docker is a mature product that comes with seccomp and standard apparmor policies ootb!
- otabdeveloper4 2y ago
  It runs as root, requires sudo to use, turns off all system firewalls, and has no way of doing security updates for containers.
  - Timber-6539 2y ago
    > It runs as root A lot of system applications on a standard Linux machine run as root or run with rootful permissions. This problem is solved by sandboxing, confining permissions and further hardening. > requires sudo to use Yes. However, this is a security plus and not a disadvantage. > turns off all system firewalls This statement makes no sense. > has no way of doing security updates for containers. I don't know what you mean by this.
throwaway894345 2y ago
There isn't a "Docker runtime", and the daemon is not a runtime any more than systemd is a runtime. They're both just managing processes. If you want to argue that Docker containers have an overhead, you could maybe argue that the Linux kernel security features they employ have an additional overhead, but that overhead is likely to be marginal compared to a less secure approach and moreover since you're Very Concerned About Security™ I'm sure you would prefer to pay the security cost.
- otabdeveloper4 2y ago
  Duplicating a base Linux distribution a thousand times for every installed piece of software absolutely is overhead. (Theoretically you could build bare images without pulling in Alpine or Ubuntu, but literally almost nobody ever does that. If you have the skills to build a bare Docker image then you don't need Docker.)
  - throwaway894345 2y ago
    > Duplicating a base Linux distribution a thousand times for every installed piece of software absolutely is overhead. You're not duplicating an entire distribution, just the user land that you want. Typically we use minimal user lands that just have certs and /etc/passwd and maybe `sh`. And to be clear, this is mostly just a disk overhead, not a CPU or memory performance overhead. > Theoretically you could build bare images without pulling in Alpine or Ubuntu, but literally almost nobody ever does that Yeah, we do that all the time. Google's "distroless" images are only about 2MiB. It's very commonly used by anyone who is remotely concerned about performance. > If you have the skills to build a bare Docker image then you don't need Docker. Building a bare Docker image isn't hard, and the main reason to use Docker in a single-host configuration is because Docker utilities are just far, far saner than systemd utilities (and also because it's just easier to distribute programs as a Docker images rather than having to deal with system package repos and managers and so on).

Timber-6539 2y ago

Insecure in what way? Rootful docker is a mature product that comes with seccomp and standard apparmor policies ootb!

otabdeveloper4 2y ago
It runs as root, requires sudo to use, turns off all system firewalls, and has no way of doing security updates for containers.
- Timber-6539 2y ago
  > It runs as root A lot of system applications on a standard Linux machine run as root or run with rootful permissions. This problem is solved by sandboxing, confining permissions and further hardening. > requires sudo to use Yes. However, this is a security plus and not a disadvantage. > turns off all system firewalls This statement makes no sense. > has no way of doing security updates for containers. I don't know what you mean by this.

throwaway894345 2y ago

There isn't a "Docker runtime", and the daemon is not a runtime any more than systemd is a runtime. They're both just managing processes. If you want to argue that Docker containers have an overhead, you could maybe argue that the Linux kernel security features they employ have an additional overhead, but that overhead is likely to be marginal compared to a less secure approach and moreover since you're Very Concerned About Security™ I'm sure you would prefer to pay the security cost.

otabdeveloper4 2y ago
Duplicating a base Linux distribution a thousand times for every installed piece of software absolutely is overhead. (Theoretically you could build bare images without pulling in Alpine or Ubuntu, but literally almost nobody ever does that. If you have the skills to build a bare Docker image then you don't need Docker.)
- throwaway894345 2y ago
  > Duplicating a base Linux distribution a thousand times for every installed piece of software absolutely is overhead. You're not duplicating an entire distribution, just the user land that you want. Typically we use minimal user lands that just have certs and /etc/passwd and maybe `sh`. And to be clear, this is mostly just a disk overhead, not a CPU or memory performance overhead. > Theoretically you could build bare images without pulling in Alpine or Ubuntu, but literally almost nobody ever does that Yeah, we do that all the time. Google's "distroless" images are only about 2MiB. It's very commonly used by anyone who is remotely concerned about performance. > If you have the skills to build a bare Docker image then you don't need Docker. Building a bare Docker image isn't hard, and the main reason to use Docker in a single-host configuration is because Docker utilities are just far, far saner than systemd utilities (and also because it's just easier to distribute programs as a Docker images rather than having to deal with system package repos and managers and so on).