wlamartin

9 ms·

31.
by wlamartin 5y ago
This is a longer term goal that we're interested in at Story.ai ( https://www.story.ai ). We think that the future is presenting the computer with a problem (in the same way you might present to a consultant) and through a pr
32.
by wlamartin 9y ago
We make use of https://github.com/onsi/ginkgo and Gomega https://github.com/onsi/gomega for BDD testing with more expressive matchers. You might be familiar with some of these concepts from Cucumb
33.
by wlamartin 9y ago
Garden makes use of runc (an Open Container Initiative project with a lot of contributions from Docker), in the same way containerd (component included in Docker) makes use of runc to run images. You won't find the docker engine being
34.
by wlamartin 9y ago
Ah that's a shame, I still suspect it would _probably_ work with the right tweaking but I appreciate there's a hurdle there that might be frustrating to overcome and that's no good. We also test a PaaS and require VM spin up
35.
by wlamartin 9y ago
Booting VMs on your worker seems like exactly the kind of debris concourse is encouraging the avoidance of by enforcing the containerisation of your builds. That said, I can't think of a reason why you couldn't boot a VM in a priv
36.
by wlamartin 9y ago
I guess I'm not clear on why you would be wanting to do this so frequently that the toggle is impractical, though it's likely that I simply haven't come across this use case.
37.
by wlamartin 9y ago
> not all things can run in garden Can you provide an example of what you'd want to do but you aren't able to?
38.
by wlamartin 9y ago
> That overlay network it comes with, garden thingy, creates so many problems and solves just one... Can you expand upon this a little bit? Garden is the containerisation piece, what about it creates problems and what single problem do y
39.
by wlamartin 9y ago
You can achieve this by clicking on a resource and hitting toggling the "power button" to off for each of the resources you don't want to include in the build.
40.
by wlamartin 10y ago
You can create a pid namespace if you also create a user namespace at the same time.
41.
by wlamartin 10y ago
I suppose we'd better return this sculpture we had made then... If you're ever over London way (where most of the CF Garden team are), we'd love to host you for something! Otherwise hopefully some conference overlap.
42.
by wlamartin 10y ago
I think this is far from truth, never mind hard truth and your example is way off point. I would say there are actions which clearly don't need an indication from the aggrieved party to recognise as abuse, such as seriously telling som
43.
by wlamartin 10y ago
I think this is a pretty poor understanding of the vulnerability. Yes, runc was split out from Docker but it now is maintained by many companies, including Red Hat - so to suggest that Docker software was "so terrible" doesn'
44.
by wlamartin 10y ago
Agree. This was the initial stance, when the focus (our misunderstanding) appeared to be on ptrace as the only vulnerability rather than ptrace as the means to easily exploit the vulnerability. Once we had a better understanding, we were al
45.
by wlamartin 10y ago
I just want to update this to clarify that it blocks ptrace, but this is only part of the issue and you shouldn't rely on AppArmor to mitigate this CVE entirely.
46.
by wlamartin 10y ago
Thanks for your comment. We (Garden - Cloud Foundry container project) released with the runc patch yesterday ( https://github.com/cloudfoundry/garden-runc-release/releases... ). It was our understanding from the or
47.
by wlamartin 10y ago
AFAIK as I know, the answer is yes. In fact if you look at the Docker apparmor documentation you can see an example where ptrace was blocked https://docs.docker.com/engine/security/apparmor/
48.
by wlamartin 10y ago
Choosing something like Cloud Foundry should help abate those fears. Backed by a foundation with some big companies donating engineering effort and providing hosted and on-premise offerings. Disclaimer: Work for Pivotal who donate the major
49.
by wlamartin 10y ago
I'm not sure if this is ironic but to me it seems you are just describing how agile is supposed to work. In my team our features are fibonacci pointed but I've seen only two 5s in the history of the project. By far the vast majori
50.
by wlamartin 10y ago
I suspect it's more likely an immediate response to https://github.com/kubernetes-incubator/cri-o People still want to use runc because it's a great piece of battle tested kit but don't want the kitchen
51.
by wlamartin 10y ago
Sweet. runC is awesome and using it is awesome. We are also super excited about the rootless work you personally have been doing, so thanks for your hard work in that area.
52.
by wlamartin 10y ago
Yep, the OCI is doing great stuff. At the bottom of the Cloud Foundry stack we have Garden-Runc ( https://github.com/cloudfoundry/garden-runc-release ). In past we had our own homegrown containerization technology and we
53.
by wlamartin 10y ago
"I maintain that meditation can have prolonged adverse effects outside the period of actual meditation." Why do you maintain this?
54.
by wlamartin 10y ago
It's a lot like BOSH however, BOSH treats dependency packaging as part of its purview. Whether this is a good thing or not is up for debate I suppose.
55.
by wlamartin 10y ago
That's fair if you don't want to make that distinction but it is common vernacular and each testing layer has a set of properties which lead to separate pros and cons. The discussion then becomes, "what are the advantages&#x2
56.
by wlamartin 10y ago
> I want to actually load the data and see it happen. Because if I don't, how do I know that my code will actually work in production? This would fall under the purview of integration/acceptance testing?
57.
by wlamartin 10y ago
You are right that docker currently runs as root. There is some phenomenal work that Aleksa Sarai is doing on getting runc to work as an unprivileged user [1] that Docker should be able to take advantage of at some point. There are still a
58.
by wlamartin 10y ago
I can't quite figure out if PHP is the only language that you can collaborate with and I don't want to start a session to let someone down. Maybe you could update the website or any of the blog posts with this info?
59.
by wlamartin 10y ago
I did read it, and believe I understood, I just wasn't sure whether to apply your criticisms of CF as a whole to Garden individually, or whether there were additional distinct technical issues that you had concerns about. The good news
60.
by wlamartin 10y ago
@sandGordon - Hey, I work for Pivotal and am the anchor of the Garden team. Is there anything in particular that has you concerned about Garden? I see jacques mentioned we're moving (very nearly have moved!) everything over to runC bac

More ›