cpuguy83

52 ms·

811.
by cpuguy83 9y ago
Images don't need to be stored in this format on disk, the format is for transport/interchange. But out of curiosity, why do you say that a dependency graph would be better here? In terms of on disk storage and transport of layers
812.
by cpuguy83 9y ago
Let me start off by saying yes it's awful that Docker is inserted at the top of the chain. This is a legacy that we'll have to work around to make work with existing rules. However, UFW is an awful iptables citizen as it assumes i
813.
by cpuguy83 10y ago
Part of the reason for removal (beyond just being difficult to maintain) is it is tied to the (now old) method of image storage where images were all just a tree of layers and any layer is considered an image even if you can't actually
814.
by cpuguy83 10y ago
A database should not affect the OS in any way. To run a database, attach non-ephemeral storage and write data there.
815.
by cpuguy83 10y ago
Not sure how configurable it is under the hood, but it's in the "Security & Privacy" preferences pane.
816.
by cpuguy83 10y ago
Hi, in addition to what others have said in response, note that the actual version is 17.03.0. Patch releases will be 17.03.X, just like 1.12.0 was the initial 1.12 release has 6 patch releases after, final one being 1.12.6.
817.
by cpuguy83 10y ago
Thanks for reporting! Looks like a typo on the store page install instructions, having this updated. In the meantime here is the correct URL: https://download.docker.com/linux/centos/docker-ce.repo
818.
by cpuguy83 10y ago
I think in this case you'd already be compromised if you have to worry about a user being able to essentially maliciously place a container. Really a job for RBAC and not the scheduler itself.
819.
by cpuguy83 10y ago
This is not fair to say at all. Everything takes time to design and implement, and human power to work on the hard/not-fun things is pretty hard to come by in such hugely active projects...
820.
by cpuguy83 10y ago
Note exactly the same (for now): > Currently, anyone with root on any node can read any secret from the apiserver, by impersonating the kubelet > If multiple replicas of etcd are run, then the secrets will be shared between them. By d
821.
by cpuguy83 10y ago
You can update a service to not use a secret once it's not needed. Of course this will restart the task(s) I think. Definitely worth thinking about. Maybe a single-read secret or something. If a service is compromised, you should alway
822.
by cpuguy83 10y ago
While the CNCF helped front the funds to get the this going, RethinkDB is totally under the Linux Foundation and not a CNCF project for now.
823.
by cpuguy83 10y ago
Would love to hear your actual complaints/issues here, though. The article just says "it doesn't work this way", hard to tell what you are having an issue with.
824.
by cpuguy83 10y ago
Stay tuned for `docker build` support for secrets, and more secret backends in later versions.
825.
by cpuguy83 10y ago
`docker ps` will never be removed.
826.
by cpuguy83 10y ago
fyi, you do not need xargs. `docker rm $(docker ps -q --filter blash)` But agree, `prune` is currently sledge hammer and needs some refinement. It's not about not being well thought out, it's about getting something out there that
827.
by cpuguy83 10y ago
It only squashes the layers produced by the build.
828.
by cpuguy83 10y ago
Squashing is down up to the `FROM` statement in the Dockerfile. Any layers from the parent image are preserved. Where this does mess things up is with content-addressable storage where if you have two layers from completely separate images
829.
by cpuguy83 10y ago
It doesn't squash the whole history, just up to the `FROM` command. But yes, it defeats one of the optimizations that content addressable storage introduced.
830.
by cpuguy83 10y ago
This isn't even true. The badge, which was a joke btw, said "I say no to systemd specific PRs."
831.
by cpuguy83 10y ago
Most likely this configuration is due to the traditional mongo use-case, which is to have data replicated between many nodes. This requires each participating node to be able to communicate with every other node.
832.
by cpuguy83 10y ago
Well, sure but then people just open the flood gates because it's such a pain in the ass to change postgres access policies. I guess secure by default means there aren't likely to be massive hacks like this, but it does not mean p
833.
by cpuguy83 10y ago
This is a really bad practice to follow. You can't rely on the network to be secure.
834.
by cpuguy83 10y ago
For #22502, I'm looking to get in a ring-buffer implementation for log drivers: https://github.com/docker/docker/pull/28762 The same could also be done for attached clients. #28889 is resolved in 1.12.4
835.
by cpuguy83 10y ago
Recent versions (1.11+) have had various race conditions around stdio handling. 1.12.4 (fingers-crossed) should resolves all the issues we've come up to at this point (hopefully that's it). The rest of the lockup issues have been
836.
by cpuguy83 10y ago
I think they understand that quite well, that's why when security gets in the way they just find a way bypass it. Security has to be usable, if it's not usable then (almost) no one will use it.
837.
by cpuguy83 10y ago
Depends on in high-performance is what you need, but this was just an example of even the container FS can have incredible integrity. Why would a container keep from using mirrored sets of SSDS, RAM, or an LB? The absolute worst case you
838.
by cpuguy83 10y ago
0. There is a plethora of documentation. Even the CLI suggests the lifecycle (start, stop, restart, pause, unpause). 1. This is simply not true. Your understanding is that they are based on being ephemeral, but this is not inherent in any s
839.
by cpuguy83 10y ago
(Classic) Swarm is just a service like any other. You can deploy it with `docker run`, which is what machine is doing for you.
840.
by cpuguy83 10y ago
I should mention Docker has a "Docker Captains" program which are a group of people who write quality articles on using docker from intro-level to advanced. https://www.docker.com/community/docker-captains

More ›