7 ms·

Does anyone run docker on a production server? Can it be used for better isolation and security? I am new to docker, so apologies if this turns out to be a naiv

by nivla 13y ago

Does anyone run docker on a production server? Can it be used for better isolation and security? I am new to docker, so apologies if this turns out to be a naive question.

justincormack 13y ago
At present you should not view Docker as a significant security enhancement. It makes processes less visible to each other, and you can use it as part of a strategy to isolate network traffic, but the kernel attack surface is unchanged.
- darkarmani 13y ago
  > At present you should not view Docker as a significant security enhancement. It makes processes less visible to each other, and you can use it as part of a strategy to isolate network traffic, but the kernel attack surface is unchanged How is process isolation not a significant security enhancement?
  - justincormack 13y ago
    Processes already should be running as different uids so they cant actually do anything to each other, so not being in the same namespace makes no real difference. There is slightly better information hiding, you cant see command lines of other processes and other info from /proc but no "significant" enhancement.
    - joevandyk 13y ago
      Processes already should be running as different uids Docker makes that way easier. If I want 3 instances of nginx running for different projects, I don't really want to setup 3 nginx users (nginx1, nginx2, nginx3). With Docker, I just start the container and it's isolated from everything else.
      - icebraining 13y ago
        In Unix & Linux, you don't need to setup users, you can just run the processes under different uids (most process managers support this). Adding a user to /etc/passwd is only needed if you want them to have an username and password.
        ghshephard 13y ago
        I had no idea this was possible - googling "process under different uid" doesn't yield anything obvious. Any hints on how to do this on a standard command linux prompt?
        lobster_johnson 13y ago
        This is one way: # sudo -u "#10000" -g "#10000" id uid=10000 gid=10000 groups=10000
        rsync 13y ago
        "I had no idea this was possible - googling "process under different uid" doesn't yield anything obvious."" I am looking at the name of this website and I see that this website is named "hacker news".
        coldtea 13y ago
        >I am looking at the name of this website and I see that this website is named "hacker news" As in "hackers"? People, that is, from all ages, that weren't necessarily born knowing everything, and are not afraid to ask around when they don't know how to do something? If so, then this is the wrong website for this kind of snark.
        cjbprime 13y ago
        So unimpressed with this arrogant, insecure behavior. See someone learning something, slap them down.
      - stevekemp 13y ago
    - FrozenCow 13y ago
      I disagree (or I'm misinformed). Aren't just unable to see other processes, but they don't see anything of the host system: the filesystem, ethernet adapters, memory usage, cpu usage, etc. Namespaces can hide a lot of information as far as I know.
      - justincormack 13y ago
        The OP was asking about process isolation in particular. You still get to see memory usage and CPU usage globally. Not being able to see the host filesystem is not a huge security benefit, again your pid should not have any significant access anyway, so this should not be a security enhancement.
        coldtea 13y ago
        >Not being able to see the host filesystem is not a huge security benefit, again your pid should not have any significant access anyway, so this should not be a security enhancement. Nope, it very much is. The fact that "your pid should not have any significant access anyway" doesn't mean that having that made certain and very easy by namespacing is not a security enhancement. Perhaps you mean something else by "security enhancement" compared to what others here mean. You seem to mean: "extra security that couldn't be achieved by totally finely tuned apps running on the host with all the proper pids and permissions". Whereas by "security enhancement" people mean: "achieving the same level of security of finely tuned apps running on the host with all the proper pids and permissions with much better EASE, and without having to repeat the whole fine tuning for each new app I add".
        JonnieCache 13y ago
        The point is, nice as it may be, it's still pretty new, and not specifically a security product. It's not appropriate to rely on it as a significant part of your security plan for your business. But still, layers and all that.
        justincormack 13y ago
        Remind me never to use any service you ever create.
  - rdtsc 13y ago
    > How is process isolation not a significant security enhancement? Significant compared to multiple threads running in same OS process, not significant compared to a fully virtualized OS. You also don't need Docker to launch multiple processes, you can do it on any modern general purpose operating system.
  - _wmd 13y ago
    The processes still have unfettered access to an interface that exposes a few million lines of C code running in ring0
odonnellryan 13y ago
That's only a potential use for Docker. Docker is awesome for several other reasons, one of which is "shipping." Google uses not Docker (that I know of) but containers for a lot of their development.
- kawsper 13y ago
  What do you mean by shipping?
  - odonnellryan 13y ago
    Shipping applications. Also, building. Lets say I have a web app - and there's a production server which runs in docker. Cool! Some port-forwarding easiness with nginx or your favorite flavor of X and it's good to go. When you want to upgrade, you run your integration tests on the new container. To "Ship" you just, well, change the port forward once you confirm it's good. If you want to change it to an entirely new server - easy. Just pull your image and create your container - then change your IP information to point to the new server. Docker is to contain things, not necessarily for security, but to make a build contained. Make it have no dependencies outside the container, other than being able to run Docker.
    - GrinningFool 13y ago
      I've been running into this line of thought quite a bit as I explore containers, but nowhere is it addressed how contained applications talk to each other. An app seldom lives on its own - it will integrate databases, API calls into other systems, etc - how are those configured reliably and correctly when in such a transient environment? Are they also containers? If so, how are they discovered? Dynamic configuration generation or does the application have to be aware of how to discover them at runtime? What about in a dev environment? It seems that configuration on a single local host would look vastly different, in spite of the same code running.
      - simonw 13y ago
        If you read through the redis service example it might answer some of your questions: http://docs.docker.io/en/latest/examples/running_redis_service/ http://docs.docker.io/en/latest/examples/running_redis_servi... It shows how a container can be "linked" to another container with an alias, and that alias then causes environment variables within the container to point to the correct IP address and port: DB_NAME=/violet_wolf/db DB_PORT_6379_TCP_PORT=6379 DB_PORT=tcp://172.17.0.33:6379 DB_PORT_6379_TCP=tcp://172.17.0.33:6379 DB_PORT_6379_TCP_ADDR=172.17.0.33 DB_PORT_6379_TCP_PROTO=tcp
deleted 13y ago
[deleted]
FrozenCow 13y ago
I'm running it on a public server. There docker separates: serving a website with nginx, running some node processes separately (proxied by nginx), running postfix and running git. Note that git is also separate from ssh of the host system. It has helped us in situations where we wanted to try new configurations of nginx and email without fiddling with the production processes. Reverting changes was also handy sometimes. It also helped us to be more flexible with versions. We're more confident about running a very recent version of nginx, which allows us to make use of the new features instead of waiting for debian to ship packages. Also less hassle with with dependencies, although the different docker instances need to be upgraded like any other VM. That said, when we set things up we were missing some features (connecting docker instances to eachother). We had to fiddle to get things the way we wanted and we're still missing some features that we have made workarounds for. I wouldn't recommend it running it in production. However for us it's worth the effort especially in the long run when Docker can handle all of our use-cases.
drdaeman 13y ago
Tried that, Docker was more of nuisance than help, so I've remained with bare lxc tools. https://news.ycombinator.com/item?id=6959864 https://news.ycombinator.com/item?id=6959864

by nivla 13y ago

Does anyone run docker on a production server? Can it be used for better isolation and security? I am new to docker, so apologies if this turns out to be a naive question.

justincormack 13y ago

At present you should not view Docker as a significant security enhancement. It makes processes less visible to each other, and you can use it as part of a strategy to isolate network traffic, but the kernel attack surface is unchanged.

darkarmani 13y ago
> At present you should not view Docker as a significant security enhancement. It makes processes less visible to each other, and you can use it as part of a strategy to isolate network traffic, but the kernel attack surface is unchanged How is process isolation not a significant security enhancement?
- justincormack 13y ago
  Processes already should be running as different uids so they cant actually do anything to each other, so not being in the same namespace makes no real difference. There is slightly better information hiding, you cant see command lines of other processes and other info from /proc but no "significant" enhancement.
  - joevandyk 13y ago
    Processes already should be running as different uids Docker makes that way easier. If I want 3 instances of nginx running for different projects, I don't really want to setup 3 nginx users (nginx1, nginx2, nginx3). With Docker, I just start the container and it's isolated from everything else.
    - icebraining 13y ago
      In Unix & Linux, you don't need to setup users, you can just run the processes under different uids (most process managers support this). Adding a user to /etc/passwd is only needed if you want them to have an username and password.
      - ghshephard 13y ago
        I had no idea this was possible - googling "process under different uid" doesn't yield anything obvious. Any hints on how to do this on a standard command linux prompt?
        lobster_johnson 13y ago
        This is one way: # sudo -u "#10000" -g "#10000" id uid=10000 gid=10000 groups=10000
      - rsync 13y ago
        "I had no idea this was possible - googling "process under different uid" doesn't yield anything obvious."" I am looking at the name of this website and I see that this website is named "hacker news".
        coldtea 13y ago
        >I am looking at the name of this website and I see that this website is named "hacker news" As in "hackers"? People, that is, from all ages, that weren't necessarily born knowing everything, and are not afraid to ask around when they don't know how to do something? If so, then this is the wrong website for this kind of snark.
        cjbprime 13y ago
        So unimpressed with this arrogant, insecure behavior. See someone learning something, slap them down.
    - stevekemp 13y ago
  - FrozenCow 13y ago
    I disagree (or I'm misinformed). Aren't just unable to see other processes, but they don't see anything of the host system: the filesystem, ethernet adapters, memory usage, cpu usage, etc. Namespaces can hide a lot of information as far as I know.
    - justincormack 13y ago
      The OP was asking about process isolation in particular. You still get to see memory usage and CPU usage globally. Not being able to see the host filesystem is not a huge security benefit, again your pid should not have any significant access anyway, so this should not be a security enhancement.
      - coldtea 13y ago
        >Not being able to see the host filesystem is not a huge security benefit, again your pid should not have any significant access anyway, so this should not be a security enhancement. Nope, it very much is. The fact that "your pid should not have any significant access anyway" doesn't mean that having that made certain and very easy by namespacing is not a security enhancement. Perhaps you mean something else by "security enhancement" compared to what others here mean. You seem to mean: "extra security that couldn't be achieved by totally finely tuned apps running on the host with all the proper pids and permissions". Whereas by "security enhancement" people mean: "achieving the same level of security of finely tuned apps running on the host with all the proper pids and permissions with much better EASE, and without having to repeat the whole fine tuning for each new app I add".
        JonnieCache 13y ago
        The point is, nice as it may be, it's still pretty new, and not specifically a security product. It's not appropriate to rely on it as a significant part of your security plan for your business. But still, layers and all that.
        justincormack 13y ago
        Remind me never to use any service you ever create.
- rdtsc 13y ago
  > How is process isolation not a significant security enhancement? Significant compared to multiple threads running in same OS process, not significant compared to a fully virtualized OS. You also don't need Docker to launch multiple processes, you can do it on any modern general purpose operating system.
- _wmd 13y ago
  The processes still have unfettered access to an interface that exposes a few million lines of C code running in ring0

odonnellryan 13y ago

That's only a potential use for Docker. Docker is awesome for several other reasons, one of which is "shipping." Google uses not Docker (that I know of) but containers for a lot of their development.

kawsper 13y ago
What do you mean by shipping?
- odonnellryan 13y ago
  Shipping applications. Also, building. Lets say I have a web app - and there's a production server which runs in docker. Cool! Some port-forwarding easiness with nginx or your favorite flavor of X and it's good to go. When you want to upgrade, you run your integration tests on the new container. To "Ship" you just, well, change the port forward once you confirm it's good. If you want to change it to an entirely new server - easy. Just pull your image and create your container - then change your IP information to point to the new server. Docker is to contain things, not necessarily for security, but to make a build contained. Make it have no dependencies outside the container, other than being able to run Docker.
  - GrinningFool 13y ago
    I've been running into this line of thought quite a bit as I explore containers, but nowhere is it addressed how contained applications talk to each other. An app seldom lives on its own - it will integrate databases, API calls into other systems, etc - how are those configured reliably and correctly when in such a transient environment? Are they also containers? If so, how are they discovered? Dynamic configuration generation or does the application have to be aware of how to discover them at runtime? What about in a dev environment? It seems that configuration on a single local host would look vastly different, in spite of the same code running.
    - simonw 13y ago
      If you read through the redis service example it might answer some of your questions: http://docs.docker.io/en/latest/examples/running_redis_service/ http://docs.docker.io/en/latest/examples/running_redis_servi... It shows how a container can be "linked" to another container with an alias, and that alias then causes environment variables within the container to point to the correct IP address and port: DB_NAME=/violet_wolf/db DB_PORT_6379_TCP_PORT=6379 DB_PORT=tcp://172.17.0.33:6379 DB_PORT_6379_TCP=tcp://172.17.0.33:6379 DB_PORT_6379_TCP_ADDR=172.17.0.33 DB_PORT_6379_TCP_PROTO=tcp

deleted 13y ago

[deleted]

FrozenCow 13y ago

I'm running it on a public server. There docker separates: serving a website with nginx, running some node processes separately (proxied by nginx), running postfix and running git. Note that git is also separate from ssh of the host system. It has helped us in situations where we wanted to try new configurations of nginx and email without fiddling with the production processes. Reverting changes was also handy sometimes. It also helped us to be more flexible with versions. We're more confident about running a very recent version of nginx, which allows us to make use of the new features instead of waiting for debian to ship packages. Also less hassle with with dependencies, although the different docker instances need to be upgraded like any other VM. That said, when we set things up we were missing some features (connecting docker instances to eachother). We had to fiddle to get things the way we wanted and we're still missing some features that we have made workarounds for. I wouldn't recommend it running it in production. However for us it's worth the effort especially in the long run when Docker can handle all of our use-cases.

drdaeman 13y ago

Tried that, Docker was more of nuisance than help, so I've remained with bare lxc tools. https://news.ycombinator.com/item?id=6959864 https://news.ycombinator.com/item?id=6959864