shykes

41 ms·

451.
by shykes 11y ago
Docker assumes it cannot trust the container's DNS resolver to respect TTL and cache in a compliant way. So it guarantees stable name->ip mapping for each container. As a result, when you point a service endpoint at another containe
452.
by shykes 11y ago
We are in fact moving towards alpine, but can't just switch the default tags overnight in case some users depend on the properties of certain distros.
453.
by shykes 11y ago
Yes please! That sounds fantastic, thanks for offering.
454.
by shykes 11y ago
Disclaimer: I work at Docker. > Nobody who built containers before Docker came along shipped an operating system in the image. Now we have gigabytes of Ubuntu alongside nginx thanks to Docker. Cool. First: I believe shipping the entire
455.
by shykes 11y ago
If I weren't busy doing Docker, I would be doing this. In fact given enough time and resources, I'm confident I will eventually find a way to leverage Docker to advance the goal of universal income somehow :) Figuring out basic in
456.
by shykes 11y ago
> You're assuming here that there aren't and never will be exploits that break out of the hypervisor. This is not the world we live in. Really? Here's what I wrote in this very thread, just above your message: If for yo
457.
by shykes 11y ago
> The distributed nature just means that if attackers find one exploit, they can apply it repeatedly to the distributed application, to give themselves an entire botnet That may or may not be true... In any case it's completely or
458.
by shykes 11y ago
I think we could spend a long time discussing the relative strengths and weaknesses of hypervisors and traditional operating systems. It's definitely not a one-size-fits-all situation (which is kind of what you're implying). In an
459.
by shykes 11y ago
Computers do run only one unikernel at a time. It's just that sometimes they are virtual computers. Remember that virtualization is increasingly hardware-assisted, and the software parts are mature. So for many use cases it's re
460.
by shykes 11y ago
That's correct, and one reason this is relevant for Docker (which is very developer-oriented). You should expect Docker to give applications much more control over their own infrastructure.
461.
by shykes 11y ago
To be more specific: the current active fleet of hypervisors (xen, vmware..) is much younger on average than the current active fleet of traditional operating systems (bsd/linux/solaris). By "younger" I mean the source c
462.
by shykes 11y ago
That would be true if applications ran on only one computer at a time. But nowadays applications run across many computers - sometimes tens of thousands of them. These applications don't need the operating system to protect processes f
463.
by shykes 11y ago
You could argue that hypervisor is a special type of OS. Compared to a "traditional OS": - hypervisor is much smaller, and as a result reduces security risk - hypervisor is younger and has less compatibility burden, so typically
464.
by shykes 11y ago
I have to say, after having contributed thousands of commits to free software, recruited hundreds of people to do the same, and directed tens of millions of dollars to open-source contributions... this stings a little. For the record I don
465.
by shykes 11y ago
If you think there's an inaccuracy, please consider filing an issue on https://github.com/docker/docs.docker.com , or even better sending a pull request to fix it.
466.
by shykes 11y ago
A well-configured recent version of Docker on a well-configured recent linux host has no known exploits. But it's a matter of risk management. The general consensus in the security community is that Linux containers (the set of kernel
467.
by shykes 11y ago
A more accurate title would be "misconfigured Docker pwned" since '--net=host' removes the container's network isolation. Still a pretty cool excuse for playing with unix socket fd passing!
468.
by shykes 11y ago
Fun fact: the creator of Alpine Linux, Natanael Copa works at Docker :)
469.
by shykes 11y ago
We will probably do that (and brief our legal team to escalate any case involving open-source projects to Docker management before taking action).
470.
by shykes 11y ago
I guess they're referring to projects like Darwin (released in 2000) and Webkit (open-sourced in 2005). They also invested heavily in LLVM starting in 2005. Those are all major strategic investments into open-source, at a time where co
471.
by shykes 11y ago
Personally I love both: minimal, secure-oriented distros like Alpine Linux, and unikernels. They will both play an important in building robust, scalable distributed systems.
472.
by shykes 11y ago
Correct, Docker doesn't care what you run inside the container. You provide a command to run, and it runs it. That command may be your application server or a traditional init process which in turn will fork multiple children. Docker
473.
by shykes 11y ago
Hi, Seccomp and user namespaces are in the Docker experimental build ( https://docker.com/experimental ) and should land in 1.10. Docker 1.9 supports all other namespaces, cgroups, pivot_root, cap drop, selinux, apparmor, uid
474.
by shykes 11y ago
Did you try runC? It's the low-level container runtime of Docker, extracted into a simple and reliable binary. It supports all the low-level APIs, you just drop a directory and json config and run it. We donated it to the Linux Foundat
475.
Debian daddy Murdock joins the unstoppable Docker crusade(theregister.co.uk)
3 points by shykes 11y ago|0 comments
476.
Dockercraft: Manage Docker containers from Minecraft(github.com)
462 points by shykes 11y ago|109 comments
477.
by shykes 11y ago
It's the Swarm API call. In other words it's "container scheduling time".
478.
by shykes 11y ago
It's a copy error. Initially we tested 30k containers, then later expanded the test to 50k. In both cases Swarm keeps scheduling without breaking a sweat.
479.
by shykes 11y ago
I think Hyper is interesting as a backend for Docker in production use cases where you need to extra isolation of VMs... But in development in doesn't make much sense to run each container in a separate VM. So I'm not convinced we
480.
by shykes 11y ago
It was a tough decision, and "completely ignored" is an unfair way to put it. The Machine maintainers are overwhelmed by pull requests adding new drivers. They are worried about maintenance load, and its impact on the quality of d

More ›