3 ms·

> Spawning containers, of course, requires you to mount the Docker socket in your web app, which is wildly insecure Dear friend, you are not a systems programm

• pzmarzly 2y ago
  To expand on this, the author is describing the so-called "Docker-out-of-Docker (DooD) pattern", i.e. exposing Docker's Unix socket into the container. Since Docker was designed to work remotely (CLI on another machine than DOCKER_HOST), this works fine, but essentially negates all isolation. For many years now, all major container runtimes support nesting. Some make it easy (podman and runc just work), some hard (systemd-nspawn requires setting many flags to work nested). This is called "Docker-in-a-Docker (DinD)".
  • waynesonfire 2y ago
    FreeBSD has supported nesting of jails natively since version 8.0, which dates back to 2009. I prefer FreeBSD to K8s.