> Containers are in Solaris Yes. > and FreeBSD forever.. Sort of... > before containers you could use virtual machines. You could if you were sufficiently

> Containers are in Solaris Yes. > and FreeBSD forever.. Sort of... > before containers you could use virtual machines. You could if you were sufficiently masochistic. Container layers improves the situation so much that it makes a qualitative difference over VMs. > The problem is that you run and download arbitrary unverified binary code in your system by design. E.g. in the docker registry or when installing a major "bigdata" related project... Is this a bigger problem with containers than with packages from e.g. an apt repository? Not sure if docker supports image signing at the moment, but I find it hard to believe this being a problem with containers in general. > It's opaque and a lot of work to check the integrity and updating becomes a nightmare when you have randomly downloaded 150 jars - of which 1 or 2 have an serious security flaw. I think the author mixes two separate points: (1) The complex state of modern software development, which is valid but is like complaining about the existence of violence, and (2) How this prevents him from compiling from source, which is plainly bogus. Reading the piece favorably, I can sympathize with the plight of sysadmins tasked with ensuring security in modern software development, with many small libraries and diversity in tools. Frankly, this should not be on sysadmins shoulders, it should be the responsibility of developers. Rather, sysadmins should be responsible for ensuring the security of the environment around what developers build. But this is made easier with deploying containers, because they provide a better shrink wrap on the code delivered from dev. In fact, Dockerfiles in particular offer a much more reasonable contract between dev/ops than the ambiguous one that existed previously, where hosts had to be polluted with all these maven packages. So while I can understand the author's frustrations, I think the diagnosis is flawed.