4 ms·
From a security point of view, segregation is A Thing these days. From a sysadmin point of view deploying a "work unit" makes a lot of sense, with the "work un
by rodgerd 11y ago
From a security point of view, segregation is A Thing these days. From a sysadmin point of view deploying a "work unit" makes a lot of sense, with the "work units" deployed many places.
- emmelaich 11y agoYes, isolation is the goal, and sadly it's for reasons of deployability, not security. This implies that the configuration tools (puppet, ansible, chef, whatever) are simply not good enough.
- vidarh 11y agoMost of the configuration tools we deal with try to bring the world from an unknown state to a sort-of known state with imperfect information. They're full of absolutely awful workarounds for not having well contained state.
- zwischenzug 11y agoIndeed, which is why I invented this: http://ianmiell.github.io/shutit/ http://ianmiell.github.io/shutit/ Phoenix deployment makes far more sense to me.
- emmelaich 11y agoAnd speaking of isolation/segregation .. We already run apps in a vm (a jvm), on a vm (vmware). If we wanted to add security, we'd turn on the jvm's security manager. Adding docker to the layers for security isolation seems a bit silly when you could turn on the security manager instead. I love docker, but adding security is not the reason.