cpuguy83

50 ms·

721.
by cpuguy83 8y ago
That's funny because getting these things right (without security issues) is quite difficult.
722.
by cpuguy83 8y ago
containerd is a project started entirely by Docker and contributed to the CNCF by Docker, and Docker is still a primary contributor and maintainer on the project. Where do you get this information from?
723.
by cpuguy83 8y ago
I would say check out buildkit, which is the tech behind "docker build"'s new builder. I don't know if the Dockerfile format is really suitable for this, but you can now build your own format and Docker can just build it
724.
by cpuguy83 8y ago
You can use macvlan (or ipvlan) with Docker, it's built in. But yes I agree (as a former Docker Inc employee and current maintainer of moby which is what Docker is built from), the default networking in Docker is often problematic... f
725.
by cpuguy83 8y ago
The code wouldn't be running in kernel space, just the setup/configuration of the environment, which really isn't any different than it is today, tbh. This seems to be more about attaching a kernel auditable id to a containe
726.
by cpuguy83 8y ago
Definitely not the first. There was one with leaking file descriptors which weren't opened with O_CLOEXEC. Another with ptrace (fixed by making the process non-dumpable).
727.
by cpuguy83 8y ago
"Privilged" means root in the container maps to root on the host, not literal "--privileged"
728.
by cpuguy83 8y ago
In terms of mitigation, simply running as non-root is not enough as it is very difficult to prevent escalation to root (e.g. suid binaries). User namespaces which is setup such that uid's in the container are not mapped to any in-use u
729.
by cpuguy83 8y ago
The thing is, you would have to disallow running as root in the system itself, including suid binaries and other things (e.g. docker exec -u root). User namespaces forces this. It's not just about not running as root, it's making
730.
by cpuguy83 8y ago
But you can just wrap whatever in a closure to scope your defer as needed. This is simple and works well.
731.
by cpuguy83 8y ago
for _, f := range fs { func() { defer f.Close() }() }
732.
by cpuguy83 8y ago
The problem is that it doesn't really force you to do error checks... and really most code I've seen doesn't really handle the error either so much as just bubble it up like a mini-exception.
733.
by cpuguy83 8y ago
Long touch can replace 3D Touch.
734.
by cpuguy83 8y ago
They don't see it as manipulative, which is the problem. They see it as "this is our product, we need a way to understand usage".
735.
Build a Docker-compatible replacement for Dockerfile using buildkit(matt-rickard.com)
4 points by cpuguy83 8y ago|1 comments
736.
by cpuguy83 8y ago
In go toh can't control the polling mechanism if you are using the Builtin types. You can drop to raw fd's and do whatever you like... of course this negates a lot of the niceties that go affords you.
737.
by cpuguy83 8y ago
If you can express your storage requirements via the existing mounts api, then yeah it's all possible. The thing to remember is mounts are implemented only at the node level, so there is no cluster-aware storage controller.
738.
by cpuguy83 8y ago
No. That's the point. Docker and k8s provide a means to express your state requirements and splits state management from process management. The trick is to express your state requirements. And yeah, you will be burned badly if you don
739.
by cpuguy83 8y ago
Again, separate the app layer from the storage layer. Why would an app dev be pushing changes to the db deployment (outside of data manipulation itself)? Just because the app dev wants to spin up a db in dev to shove their data into doesn&#
740.
by cpuguy83 8y ago
I would not run a database on swarm. It simply does not have the right api's at the cluster level to properly express state requirements. The original swarm design had some of this but it was pulled just before release for more design
741.
by cpuguy83 8y ago
A database is an application like any other. Containers are about managing the lifecycle of the process and container managers assist in getting the right state to a container. Wether or not a container has state or not doesn't make it
742.
by cpuguy83 8y ago
Sorry, this seems to insinuate that Docker is slowing down (or using slow) storage... this is completely false. Volumes in docker are just host bind mounts. Now depending on your driver/opts (similar to K8s PV backends) this storage ca
743.
by cpuguy83 8y ago
Ok...? No one said anything like this. Just saying binctr is not some new project just hitting the scene.
744.
by cpuguy83 8y ago
binctr is like 3 years old.
745.
by cpuguy83 8y ago
Fundamentally they share a kernel with the host. This has its own implications. Beyond that it is very difficult to get things right, and there's definitely some information leakage (e.g. see the output of `mount` in a docker container
746.
by cpuguy83 8y ago
Totally, but that's the point. Most people probably don't actually need an extra day off (I mean, I'd take one, but...) to stymie burnout but rather a calmer, more sane environment when they are working.
747.
by cpuguy83 8y ago
It's not the number of days but the constant fire drills, everything is always top priority, notifications coming at all hours... and at least with software dev very rarely is it a priority to fix poor quality things thereby making eve
748.
by cpuguy83 8y ago
> As long as the FROM field in your Dockerfile points to `$distro:latest` from Cloud Marketplace I read this perhaps the wrong way, in which case I apologize on that front.
749.
by cpuguy83 8y ago
> But, there's nothing to say that the upstream distro would accept the changes If upstream didn't accept it, then it shouldn't be masquerading as what upstream is... which is what changing `FROM $image` to point to Google
750.
by cpuguy83 8y ago
Disclosure: I work at Microsoft on Azure, previously at Docker on the core engine.

More ›