jpetazzo

8 ms·

31.
by jpetazzo 13y ago
Each container will have a "fixed-size filesystem", but: - it will be thinly provisioned (i.e. it can be 10G or 100G but still use only a few MB on disk if it's essentially empty, like a sparse file), - it can be grown easily
32.
by jpetazzo 13y ago
The Dockerfile provides caching. When you tweak a few things, you don't have to re-run the whole script, which is great if there are some expansive steps (e.g. downloading and installing Java, compiling a big library, etc.) Of course,
33.
by jpetazzo 13y ago
Allow me to apologize if I sound blunt, but I think you missed the point of Dokku. It is a, what, 100 lines shell script? It supports a single app, but you can run it multiple times. The same way that Heroku supports a single app per git r
34.
by jpetazzo 13y ago
Others will correct me if I'm wrong, but Deis particularly makes sense, since Dokku has a more restricted scope, and Flynn isn't out yet. Also, the required glue is a bit more complicated than you think, especially when you want t
35.
by jpetazzo 13y ago
... That's something that I would love to do once Docker has pluggable backends. However (please don't throw stones at me if I'm wrong) I thought it wasn't possible to do "zones within zones"; did that change
36.
by jpetazzo 13y ago
Fair point; but this is not using IPSec. It's using OpenVPN, which relies on TUN/TAP.
37.
by jpetazzo 13y ago
That's not the only thing I'm doing on this VM; as I pointed out, I'm consolidating lots of little hacks and projects that are running all over the place in different environments. I put each thing in its own container. Benef
38.
by jpetazzo 13y ago
Thanks for your feedback! Agreed, the approach is far from perfect. 1. Process supervision is kept very simple, because there are many other tutorials and demos out there using Supervisor and other systems. I'd love to know what is inh
39.
Docker + Joyent + OpenVPN = Bliss(blog.docker.io)
71 points by jpetazzo 13y ago|23 comments
40.
by jpetazzo 13y ago
Yeah, still true, but we are actively working on an alternate implementation to be compatible with anything post 3.2 and RHEL 6.4 as well.
41.
by jpetazzo 13y ago
There is already some support for Gentoo and Archlinux, and if you are willing to use a "foreign" kernel, Red Hat / Fedora / CentOS work as well. There is some significant work in progress to add compatibility for non-AU
42.
by jpetazzo 13y ago
Yeah... Note for future self: make all the mandatory lame jokes in the blog post itself, so people don't feel obligated to do them on HN instead. ;-)
43.
by jpetazzo 13y ago
Are you looking forward to run the Docker CLI in Windows (i.e., being able to use Docker commands from a Windows machine, while the containers run on a remote box), or run the containers themselves on a Windows box?
44.
by jpetazzo 13y ago
Depends what you have in mind, I guess. You could run most essential system components (syslog, ssh, cron...) inside containers, and bind-mount /home when it makes sense. Since those components need elevated privileges, I don't kn
45.
by jpetazzo 13y ago
We're on the same page. That's my next hack — an OpenVPN server within Docker. The blog post, Dockerfile, and helper scripts should be out next week :-)
46.
by jpetazzo 13y ago
Yes, you can do that; I would personally ship the containers separately and provide minimal orchestration. Why? Because if you bundle multiple containers together, they will run on a single host. And if they run on a single host, it's
47.
by jpetazzo 13y ago
Cgroups and namespaces. Even though some namespaces are nested (typically, the PID namespace) why others don't need to be. There is nothing special with nesting cgroups and namespaces from the kernel point of view. The interesting pa
48.
by jpetazzo 13y ago
This is one of the many potential applications of the new "-privileged" flag of Docker. This is very exciting, because it means that we will soon run Docker CI within Docker itself (instead of ad-hoc VMs), among other things!
49.
Docker can now run within Docker(blog.docker.io)
150 points by jpetazzo 13y ago|45 comments
50.
by jpetazzo 13y ago
If you are on Linux 3.8, lxc-attach should work. I use it on a regular basis and never saw any problem (as long as I was on Linux 3.8). The exact syntax is "lxc-attach -n $FULL_CONTAINER_ID", and you can get the full container ID
51.
by jpetazzo 13y ago
I wouldn't consider it "widely deployed" compared to the Linux installed base. Sure, Joyent (and others) has "deployed hundreds of thousands of zones into production over the years", but you guys are the only well-k
52.
by jpetazzo 13y ago
Regarding the lxc.drop vs lxc.keep: of course, we eventually want to switch to the latter, since it's obviously better to "deny all, then allow some" than the opposite. And I can only be grateful that you provided those eleme
53.
by jpetazzo 13y ago
I disagree with this assertion that "VMs will always be more secure". Of course, they bring an extra layer (or rather, a layer of different nature). But check the number of Xen vulnerabilities (I kept up with those for a while bec
54.
by jpetazzo 13y ago
True, I will update the blog post so that it feels less misleading. Source code for Solaris zones is indeed available; but I wouldn't consider it widely deployed. Of course, some people are using it in public hosting environments (the
55.
by jpetazzo 13y ago
Are you implying that gaining root access inside a LXC container means that you can escalate to the host system, or to sibling containers? If yes, I would like to see an example of that (that works on systems with very minimal lockdown, i.e
56.
by jpetazzo 13y ago
By the way, if anyone knows of a documented exploit for LXC, I would love to hear about it. People (generally advocating VMs, zones, jails, OpenVZ...) will often say that "containers are not secure", but once you've taken som
57.
Containers and Docker: how secure are they?(blog.docker.io)
117 points by jpetazzo 13y ago|54 comments
58.
by jpetazzo 13y ago
It's basically what you get when you start your deployment toolchain as simple shell scripts, then make them evolve, add features, and at some point, rewrite from scratch with a "real" programming language. I don't know
59.
by jpetazzo 13y ago
Actually, I've ran Docker within QEMU within Docker (using v9fs so that QEMU could use the container's FS as root FS). Works, but painfully slow and not very resource-efficient :-)
60.
by jpetazzo 13y ago
Sorry, but this is FUD: > IF you have root on the container, you have root on the host. This is only true on badly configured systems. If you run some kind of public shared hosting (like Heroku, dotCloud, etc.) you probably slap some ext

More ›