6 ms·
Security-wise, if I understand correctly, this is a very interesting offering. 1. The containers live on "your" VMs so you get the isolation of a virtual machi
by St-Clock 12y ago
Security-wise, if I understand correctly, this is a very interesting offering.
1. The containers live on "your" VMs so you get the isolation of a virtual machine and do not worry about the other tenants' containers.
2. The VMs are part of a "private cloud", i.e., the internal network is not accessible by other tenants' VMs and containers.
#2 is what worried me the most in other container service offerings. It's easy to overlook protecting your internal ip when you manage VMs, it's even easier (and expected) when you deploy containers.
- kalgen 12y agoThese are also properties of Google Container Engine. Which other container service offerings were you thinking of?
- dividuum 12y agoDigital Ocean has something called "Private Networking" that's internal to the data center but shared with all other customers. It's not obvious from reading the website that this is the case.
- estsauver 12y agoI actually think they're almost intentionally a touch deceptive. "Private" is a really loaded term to use there.
- SoreGums 12y agoNot really, common to refer to Private IP's as "private IP address space" as per RFC 1918(IPv4)/RFC 4193(IPv6). If a user of the service is wanting to get on board, it is their responsibility to ensure what they think is accurate or not.
- inopinatus 12y agoWhen a door is marked "Private", then the room beyond is generally a shared space for all those authorized to access.
- kelleyk 12y agoLinode's is the same. I agree that it's annoying and that the terminology is slightly deceptive. Any of these "datacenter LANs", though, tend to be fast and free (in terms of bandwidth). We just use a VPN overlay and call it a day.
- deleted 12y ago[deleted]
- joshpadnick 12y agoI'm here at AWS reinvent and just saw the EC2 Container Service presentation. They specifically targeted security as part of their design. Basically, you launch a cluster of EC2 instances that are "available" for containers to launch into. So these are your instances, running in your VPCs. It's really the same security profile as the standard VPCs plus any other security issues your particular docker containers expose.