fabiokung

3 ms·

1. 1.▲
   by fabiokung 12y ago

   Great response. "..., or ideally don't grant root access to the application." +1
2. 2.▲
   by fabiokung 13y ago

   It's possible, but only part of a possible solution. Those tools still would need a (standard) place to read cgroup specific data from inside the container.
3. 3.▲
   by fabiokung 13y ago

   Heroku engineer here. Thanks for the suggestion, we will definitely consider it in the future. Meanwhile, there is an add-on that does exactly this: https://addons.heroku.com/proximo
4. 4.▲
   by fabiokung 13y ago

   It is still abstracted, nothing changes from the point of view of most applications. It just opens more possibilities and increases the isolation.
5. 5.▲
   by fabiokung 13y ago

   Not all services support unix domain sockets. It's one more option on the table, but I agree that domain sockets should be favored in most cases.
6. 6.▲
   by fabiokung 13y ago

   `heroku run bash` is still the best option, but I've always wanted to ssh into heroku dynos myself, so I did this: https://github.com/fabiokung/heroku-ssh